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DOD  FINANCIAL  MANAGEMENT 

Improvement  Needed  in  DOD  Components' 
Implementation  of  Audit  Readiness  Effort 


Why  GAO  Did  This  Study 


What  GAO  Found 


The  Department  of  Defense  (DOD)  has 
been  required  to  prepare  audited 
annual  financial  statements  since  1997 
but  to  date,  has  not  been  able  to  meet 
this  requirement.  The  National 
Defense  Authorization  Act  of  Fiscal 
Year  2010  mandated  that  DOD  be 
prepared  to  validate  [certify]  that  its 
consolidated  financial  statements  are 
audit-ready  by  September  30,  2017.  In 
May  2010,  DOD  issued  its  Financial 
Improvement  and  Audit  Readiness 
(FIAR)  Guidance  to  provide  a 
methodology  for  DOD  components  to 
follow  to  develop  and  implement  their 
Financial  Improvement  Plans  (FlPs)for 
achieving  audit  readiness.  The  DOD 
FIP  is  a  framework  for  planning  and 
tracking  the  steps  and  supporting 
documentation. 

GAO  was  asked  to  assess  the  FIP 
methodology  provided  in  the  FIAR 
Guidance,  the  development  and 
implementation  of  selected 
components’  FIPs,  and  DOD’s 
monitoring  and  oversight  of  the  FIP 
process.  To  do  this,  GAO  analyzed 
the  FIAR  Guidance,  reviewed  two 
selected  FIPs — Navy  Civilian  Pay  and 
Air  Force  Military  Equipment — and 
reviewed  relevant  documentation  and 
interviewed  DOD  and  component 
officials. 

What  GAO  Recommends 

GAO  recommends  that  the  Secretary 
of  Defense  take  various  actions  to 
improve  the  development, 
implementation,  documentation,  and 
oversight  of  DOD’s  financial 
management  improvement  efforts. 

DOD  generally  concurred  with  the 
recommendations  and  commented  on 
actions  being  taken  to  implement  them. 


The  FIAR  Guidance  provides  a  reasonable  methodology  for  DOD  components  to 
use  in  developing  and  implementing  their  FIPs.  The  Guidance  details  the  roles 
and  responsibilities  of  the  DOD  components,  and  prescribes  a  standard, 
systematic  process  to  follow  to  assess  processes,  controls,  and  systems. 

Overall,  the  procedures  required  by  the  FIAR  Guidance  are  consistent  with 
selected  procedures  for  conducting  a  financial  audit,  such  as  testing  internal 
controls  and  information  system  controls.  The  Guidance  also  requires 
components  to  take  actions  to  correct  any  deficiencies  identified  during  testing 
and  document  the  results.  DOD’s  ability  to  achieve  departmentwide  audit 
readiness  is  highly  dependent  on  its  military  components’  ability  to  effectively 
develop  and  implement  FIPs  in  compliance  with  the  FIAR  Guidance. 

The  Navy  and  Air  Force  did  not  adequately  develop  and  implement  their 
respective  FIPs  for  Civilian  Pay  and  Military  Equipment  in  accordance  with  the 
FIAR  Guidance.  GAO  found  similar  deficiencies  in  both  FIPs.  For  example, 
internal  controls  and  information  systems  controls  were  not  sufficiently  tested  or 
documented,  and  conclusions  reached  were  not  supported  by  the  testing  results. 
In  addition,  neither  component  had  fully  developed  and  implemented  corrective 
action  plans  to  address  deficiencies  identified  during  implementation  of  the  FIPs. 
As  a  result,  the  FIPs  did  not  provide  sufficient  support  for  the  Navy’s  and  Air 
Force’s  conclusions  that  Civilian  Pay  and  Military  Equipment  were  ready  to  be 
audited. 

DOD  and  its  military  components  have  assigned  to  senior  executive  committees 
and  designated  individuals  appropriate  oversight  roles  and  responsibilities  for 
their  financial  improvement  efforts.  However,  neither  oversight  committees  nor 
Navy  and  Air  Force  officials  effectively  carried  out  their  oversight  responsibilities 
for  the  two  FIPs,  which  did  not  support  the  components’  conclusions  of  audit 
readiness.  However,  once  the  components  indicated  audit  readiness,  both  the 
DOD  Office  of  Inspector  General  and  the  Undersecretary  of  Defense 
(Comptroller)  performed  reviews  and  concluded  that  the  FIPs  did  not  comply  with 
the  FIAR  Guidance  and  did  not  demonstrate  audit  readiness.  The  lack  of 
adequate  oversight  results  in  an  ineffective  FIP  process  and  can  impact  the 
ability  of  components  to  meet  established  milestones.  If  the  components  are 
unable  to  achieve  interim  milestones,  DOD  will  need  to  consider  how  these 
factors  could  affect  its  ability  to  achieve  departmentwide  auditability  by  the  end  of 
fiscal  year  2017. 
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United  States  Government  Accountability  Office 
Washington,  DC  20548 


September  13,  201 1 
Congressional  Requesters 

Since  1997,  the  Department  of  Defense  (DOD)  has  been  required  to 
prepare  annual  audited  departmentwide  financial  statements.1  However, 
because  of  long-standing  and  pervasive  financial  management 
weaknesses,  DOD  has  not  been  able  to  meet  this  requirement.  The 
National  Defense  Authorization  Act  (NDAA)  for  Fiscal  Year  20022 
required  DOD  to  minimize  the  resources  spent  to  develop,  compile, 
report,  and  audit  financial  statements  until  the  department  sufficiently 
addresses  its  financial  management  weaknesses  such  that  it  can  assert 
to  the  Inspector  General  that  its  financial  statements  are  reliable. 
Because  of  concerns  about  the  limited  progress  made,  the  NDAA  for 
Fiscal  Year  201 03  mandated  that  DOD  be  prepared  to  validate  [certify] 
that  its  consolidated  financial  statements  are  ready  for  audit  by 
September  30,  2017. 

The  NDAA  for  fiscal  year  201 0  also  mandated  that  DOD  (1 )  develop  and 
maintain  a  Financial  Improvement  and  Audit  Readiness  (FIAR)  Plan  that 
includes,  among  other  things,  the  specific  actions  to  be  taken  and  costs 
associated  with  correcting  the  financial  management  deficiencies  that 
impair  the  department’s  ability  to  prepare  timely,  reliable,  and  complete 
financial  management  information;  (2)  provide  semiannual  reports  on  the 
status  of  the  department’s  implementation  of  the  FIAR  Plan  (which  DOD 
provides  as  FIAR  Plan  Status  Reports);  (3)  develop  standardized 
guidance  for  DOD  components’  Financial  Improvement  Plans  (FIP);4  and 


1  The  Chief  Financial  Officers  Act  of  1990,  Pub.  L.  No.  101-576,  title  III,  §  303,  104  Stat. 
2838,  2849  (Nov.  15,  1990),  initially  required  annual  audited  financial  statements  of 
certain  DOD  components  and  activities,  but  the  Government  Management  Reform  Act  of 
1994,  Pub.  L.  No.  103-356,  §  405,  108  Stat.  3410,  3415  (Oct.  13,  1994)  expanded  the 
annual  requirement  to  departmentwide  financial  statements  beginning  with  fiscal  year 
1996,  which  at  the  time  had  to  be  prepared  no  later  than  March  1,  1997.  See  31  U.S.C.  § 
3515. 

2  Pub.  L.  No.  107-107,  §  1008,  115  Stat.  1012,  1205  (Dec.  28,  2001). 

3  Pub.  L.  No.  111-84,  §  1 003(a), (b),  123  Stat.  2190,  2439-40  (Oct.  28,  2009). 

4  The  DOD  FIP  is  a  framework  for  planning  and  tracking  the  steps  and  supporting 
documentation  necessary  to  achieve  auditability  within  the  FIAR  Methodology. 
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(4)  define  oversight  roles  and  assign  accountability  for  carrying  out  the 
FIAR  Plan  to  appropriate  officials  and  organizations. 

In  May  2010,  the  DOD  Comptroller  issued  the  FIAR  Guidance  which 
defines  DOD’s  strategy,  goals,  roles,  responsibilities,  and  procedures  for 
the  components  to  become  audit  ready.  More  specifically,  the  Guidance 
provides  a  standard  methodology  for  DOD  components  to  follow  in 
developing  and  implementing  their  FIPs.  In  September  2010,  we  reported 
that  the  department  needed  to  focus  on  implementing  its  FIAR  Plan  and 
that  the  key  to  successful  implementation  would  be  the  efforts  of  the  DOD 
military  components  and  the  quality  of  their  individual  FIPs.5  We  also 
reported  that  DOD  would  need  the  sustained  commitment  of  its  top 
leadership,  departmentwide  and  within  its  components,  to  address 
weaknesses  and  produce  financial  management  information  that  is 
timely,  reliable,  and  useful  for  managers  throughout  DOD. 

To  assist  Congress  in  its  oversight  of  DOD’s  financial  management 
improvement  efforts,  you  requested  that  we  assess  the  implementation  of 
DOD’s  FIAR  Plan  Strategy  by  reviewing  the  military  components’  FIPs.  In 
response,  our  objectives  were  to  determine  whether  (1)  the  FIAR 
Guidance  provided  a  reasonable  methodology  for  DOD  components  to 
develop  FIPs,  (2)  the  DOD  components  had  adequately  developed  and 
implemented  selected  FIPs  in  accordance  with  the  FIAR  Guidance,  and 
(3)  DOD  is  adequately  monitoring  and  overseeing  the  FIP  process. 

To  address  the  first  objective,  we  analyzed  the  current  FIAR  Guidance, 
issued  in  May  2010,  using  relevant  criteria  to  determine  if  it  provides  a 
reasonable  methodology  for  achieving  financial  statement  auditability.6  To 
address  the  second  objective,  we  selected  FIPs  for  two  assessable 


5  GAO,  Department  of  Defense:  Financial  Management  Improvement  and  Audit 
Readiness  Efforts  Continue  to  Evolve,  GAO-10-1059T  (Washington,  D.C.:  September 
2010). 

6  GAO  and  the  President’s  Council  on  Integrity  and  Efficiency  (PCIE),  Financial  Audit 
Manual  (FAM),  GAO-08-585G  (Washington,  D.C.:  July  2008);  Federal  Information 
System  Controls  Audit  Manual  (FISCAM),  GAO-09-232G  (Washington,  D.C.:  February 
2009);  Standards  for  Internal  Control  in  the  Federal  Government,  GAO/AIMD-OO-21.3.1 
(Washington,  D.C.:  November  1999);  Office  of  Management  and  Budget  (OMB)  Circular 
No.  A-123,  Management’s  Responsibility  for  Internal  Control  (revised  December  2004). 
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units7 — Navy  Civilian  Pay  and  Air  Force  Military  Equipment — that  were 
scheduled  to  assert  audit  readiness  in  calendar  year  2010.  We  analyzed 
the  FIP  documentation  supporting  the  audit  readiness  assertions,8  such 
as  process  flows,  control  assessments,  and  test  plans  and  results  using 
the  FIAR  Guidance.  We  did  not  perform  separate  audit  procedures  to 
assess  the  effectiveness  of  the  controls  or  the  completeness  or  accuracy 
of  the  Navy  civilian  pay  amounts  or  the  Air  Force  military  equipment.  To 
address  the  third  objective,  using  relevant  criteria,9  we  analyzed 
documentation,  such  as  the  FIAR  Guidance,  FIAR  Plan  Status  Reports,10 
and  committee  charters,  to  determine  if  the  department  had  assigned 
monitoring  and  oversight  responsibilities  to  the  appropriate  entities  and 
officials,  and  had  properly  defined  their  roles  and  responsibilities.  In 
addition,  for  all  three  objectives,  we  met  with  officials  involved  in 
developing,  implementing,  or  monitoring  the  components’  FIP  efforts  to 
obtain  explanations  and  clarification  as  needed. 

Further  details  on  our  scope  and  methodology  are  provided  in  appendix  I. 
We  conducted  this  performance  audit  from  May  2010  to  September  2011 
in  accordance  with  generally  accepted  government  auditing  standards 
(GAGAS).  Those  standards  require  that  we  plan  and  perform  the  audit  to 
obtain  sufficient,  appropriate  evidence  to  provide  a  reasonable  basis  for 
our  findings  and  conclusions  based  on  our  audit  objectives.  We  believe 
the  evidence  obtained  provides  a  reasonable  basis  for  our  findings  and 
conclusions  based  on  our  audit  objectives. 


Background 


For  over  a  decade,  DOD  has  dominated  GAO’s  list  of  federal  programs 
and  operations  at  high  risk  of  being  vulnerable  to  fraud,  waste,  abuse, 


7  An  assessable  unit  can  be  any  part  of  the  financial  statements,  such  as  a  line  item  or  a 
class  of  assets  (e.g.,  civilian  pay  or  military  equipment),  a  class  of  transactions,  or  it  can 
be  a  process  or  a  system  that  helps  produce  the  financial  statements. 

8  FIP  documentation  includes  evidence  of  the  components’  implementation  of  financial 
improvement  plans  as  well  as  results  of  those  efforts.  Throughout  this  report,  we  use  the 
term  “FIP”  to  mean  the  documentation  that  was  used  to  support  a  component’s  assertion 
of  audit  readiness,  which  is  a  key  step  in  the  FIAR  Methodology. 

9  OMB  Circular  No.  A-123,  Appendix  A,  Internal  Control  Over  Financial  Reporting. 
i  n 

DOD,  Fiscal  Year  2010  Financial  Improvement  and  Audit  Readiness  (FIAR)  Guidance 
(May  15,  2010);  DOD,  Financial  Improvement  and  Audit  Readiness  (FIAR)  Plan  Status 
Report  (November  2010);  DOD,  Financial  Improvement  and  Audit  Readiness  (FIAR)  Plan 
Status  Report  (May  201 1 ). 
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and  mismanagement.11  All  of  DOD’s  programs  on  GAO’s  High-Risk  List 
relate  to  its  business  operations,  including  systems  and  processes  related 
to  the  management  of  contracts,  finances,  the  supply  chain,  and  support 
infrastructure,  as  well  as  weapons  system  acquisition.  Long-standing  and 
pervasive  weaknesses  in  DOD’s  financial  management  and  related 
business  processes  and  systems  have  (1)  resulted  in  a  lack  of  reliable 
information  needed  to  make  sound  decisions  and  report  on  the  financial 
status  and  cost  of  DOD  activities  to  Congress  and  DOD  decision  makers, 
(2)  adversely  affected  its  operational  efficiency  in  business  areas  such  as 
major  weapons  system  acquisition  and  support  and  logistics,  and  (3)  left 
the  department  vulnerable  to  fraud,  waste,  and  abuse. 

DOD  is  required  by  various  statutes  to  improve  its  financial  management 
processes,  controls,  and  systems  to  ensure  that  complete,  reliable, 
consistent,  and  timely  information  is  prepared  and  responsive  to  the 
financial  information  needs  of  agency  management  and  oversight  bodies, 
and  to  produce  annual  audited  financial  statements.  As  noted  above, 

DOD  has  been  required  since  1997  to  prepare  and  issue  annual 
departmentwide  audited  financial  statements  and,  pursuant  to  various 
statutes,  certain  DOD  components,  including  the  military  departments, 
are  required  to  prepare  and  issue  annual  audited  financial  statements. 
DOD  consolidates  the  component  financial  statements  to  prepare  its 
departmentwide  financial  statements.  As  reflected  in  OMB  requirements 
and  DOD  policy12  for  preparation  and  audit  of  agency  financial 
statements,  DOD  and  its  components  must  prepare  their  financial 
statements  consistent  with  generally  accepted  accounting  principles 
(GAAP)13  and  establish  and  maintain  effective  internal  control  over 
financial  reporting  and  compliance  with  laws  and  regulations.  The  DOD 
Office  of  Inspector  General  (OIG)  is  responsible  for  auditing  the  financial 
statements  in  accordance  with  GAGAS,  which,  among  other  things, 
requires  the  auditor  to  determine  if  the  financial  statements  are  fairly 
presented  and  properly  supported  by  the  agencies’  accounting  records. 


11  GAO,  High  Risk  Series:  An  Update,  GAO-11-278  (Washington,  D.C.:  February  2011). 

12  OMB  Circular  No.  A-136;  OMB  Bulletin  No.  07-04,  as  amended;  and  DOD  Financial 
Management  Regulation,  Volume  6B,  Chapters  1  and  2. 

13  GAAP  for  federal  agencies  are  issued  by  the  Federal  Accounting  Standards  Advisory 
Board,  a  federal  advisory  committee  sponsored  by  OMB,  the  Treasury,  and  GAO. 


Page  4 


GAO-1 1-851  DOD  Financial  Management 


DOD  has  undertaken  a  number  of  initiatives  over  the  years,  such  as  its 
Financial  Improvement  Initiative  in  2003,  to  improve  the  department’s 
business  operations,  including  financial  management,  and  achieve 
unqualified  (or  “clean”)  financial  statement  audit  opinions.  In  2005,  the 
DOD  Comptroller  established  the  DOD  FIAR  Directorate  to  manage 
DOD-wide  financial  management  improvement  efforts  and  to  integrate 
those  efforts  with  transformation  activities,  such  as  those  outlined  in  the 
department’s  Enterprise  Transition  Plan,  across  the  department. 

The  FIAR  Plan,  which  was  first  prepared  in  2005,  is  DOD’s  strategic  plan 
and  management  tool  for  guiding,  monitoring,  and  reporting  on  the 
department’s  financial  management  improvement  efforts.  As  such,  the 
plan  communicates  incremental  progress  in  addressing  the  department’s 
financial  management  weaknesses  and  achieving  financial  statement 
auditability.  The  plan  focuses  on  three  goals:  (1)  achieve  and  sustain 
unqualified  assurance  on  the  effectiveness  of  internal  controls  through  the 
implementation  of  sustained  improvements  in  business  processes  and 
controls  addressing  the  material  internal  control  weaknesses,  (2)  develop 
and  implement  financial  management  systems  that  support  effective 
financial  management,  and  (3)  achieve  and  sustain  financial  statement 
audit  readiness.  The  NDAA  for  Fiscal  Year  2010  requires  DOD  to  update 
and  report  on  the  FIAR  Plan  twice  a  year — no  later  than  May  15  and 
November  15 — and  provide  each  update  to  OMB  and  Congress,  among 
others. 

Consistent  with  prior  GAO  recommendations14  and  the  NDAA  for  Fiscal 
Year  2010,  the  DOD  Comptroller  issued  the  FIAR  Guidance  in  May  2010 
to  provide  standardized  guidance  for  DOD  components  to  follow  in 
developing  their  FIPs.  DOD  components  are  expected  to  prepare  a  FIP  in 
accordance  with  the  FIAR  Guidance  for  each  of  their  assessable  units. 
The  FIPs  are  intended  to  both  guide  and  document  financial  improvement 
efforts.  While  the  name  “FIP”  indicates  that  it  is  a  plan,  as  a  component 
implements  that  plan,  it  must  document  the  steps  performed  and  the 
results  of  those  steps,  and  retain  that  documentation  within  the  FIP. 
Therefore,  a  FIP  includes  plans  for  testing  controls  and  data,  and 
documentation  of  the  testing  conducted,  results  of  the  testing,  and  any 
actions  taken  based  on  the  results.  When  a  component  determines  that  it 
has  completed  sufficient  financial  improvement  efforts  for  an  assessable 


14  GAO-09-373. 
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unit  so  that  it  is  ready  for  audit,  the  FIP  documentation  is  used  to  support 
the  conclusion  of  audit  readiness. 

A  summary  of  the  purpose  of  each  DOD  financial  improvement  document 
is  provided  below. 


Table  1:  Description  of  Key  FIAR  Documents 

FIAR  document 

Description 

FIAR  Plan 

•  Defines  DOD’s  strategy  and  plan  for  (1 )  improving  business 
and  financial  management,  (2)  prioritizing  needs,  and  (3) 
identifying  plans  to  remediate  deficiencies  and  dependencies 
impeding  auditability. 

•  First  issued  in  2005  and  is  updated  semiannually  in  the  FIAR 
Plan  Status  Reports,  which  also  summarize  the  current  status 
of  DOD  and  its  components  in  executing  the  FIAR  Plan 

Strategy. 

FIAR  Guidance 

•  Further  defines  DOD’s  goals,  strategy,  roles,  responsibilities, 
and  procedures  as  well  as  the  FIAR  Methodology  for  becoming 
audit  ready. 

•  Functions  as  a  handbook  and  a  standard  reference  guide 
detailing  the  steps  that  DOD  reporting  entities  should  use  to 
achieve  audit  readiness. 

•  First  issued  in  May  2010  and  is  to  be  updated  annually. 

FIP 

•  A  standard  framework  of  steps  and  documentation 
requirements  that  aligns  to  the  FIAR  Methodology. 

•  Is  governed  by  the  FIAR  Methodology,  FIAR  Plan  Strategy, 
and  the  standard  FIP  template  contained  in  the  FIAR 

Guidance. 

•  Reporting  entities  develop  and  execute  a  FIP  for  each  of  their 
assessable  units  or  combinations  of  assessable  units. 

•  Components  apply  the  framework  by  performing  the  requisite 
steps  including  asserting  that  an  assessable  unit  is  audit-ready 
and  compiling  all  applicable  supporting  documentation. 

Source:  GAO  analysis  of  DOD  data. 


The  department  intends  to  progress  toward  achieving  financial  statement 
auditability  in  five  “waves”  of  concerted  improvement  activities  within 
groups  of  end-to-end  business  processes,  which  are  broken  down  into 
discrete  units,  called  assessable  units.  Under  the  FIAR  Plan  Strategy, 
execution  of  the  FIAR  Guidance  methodology  for  groups  of  assessable 
units  across  the  five  waves  is  intended  to  result  in  the  preparation  of 
various  components’  financial  statements  through  fiscal  year  2017. 

The  first  three  waves  of  the  FIAR  Plan  Strategy  focus  on  achieving  the 
DOD  Comptroller’s  interim  budgetary  and  asset  accountability  priorities, 
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while  the  remaining  two  waves  are  intended  to  complete  actions  needed 
to  achieve  full  financial  statement  auditability.  However,  the  department 
has  not  yet  fully  defined  its  strategy  for  completing  waves  4  and  5,  which 
focus  on  the  auditability  of  most  of  the  department’s  financial  statements 
such  as  the  Balance  Sheet  and  the  Statement  of  Net  Cost,  and  significant 
audit  areas  such  as  equipment  valuation.  The  FIAR  Guidance  states  that 
an  analysis  of  significant  reporting  entities  relevant  to  waves  4  and  5  will 
be  included  in  a  future  version  of  the  FIAR  Guidance.  For  example,  in 
relation  to  wave  4,  the  DOD  Comptroller  has  identified  weaknesses  in 
DOD  valuation  of  military  equipment  as  an  obstacle  to  achieving  auditable 
balances  in  DOD  financial  statements,  and  the  May  2011  FIAR  Status 
Plan  Report  states  that  DOD  plans  to  resolve  the  matter  through  the 
deployment  of  new  business  and  financial  management  systems,  a 
revised  definition  of  military  equipment,  and  through  a  change  to  GAAP 
related  to  accounting  for  the  cost  of  military  equipment.  DOD  plans  to 
seek  a  change  to  GAAP  and  implement  the  change  by  September  30, 
2017,  but  DOD  has  not  yet  prepared  a  detailed  time  line  for  implementing 
the  changes  within  affected  assessable  units  (assuming  that  any 
proposed  changes  to  GAAP  would  be  approved). 

The  focus  and  scope  of  each  wave  include  the  following: 

Wave  1 — Appropriations  Received  Audit  focuses  efforts  on  assessing 
and  strengthening,  as  necessary,  internal  controls  and  business  systems 
involved  in  the  appropriations  receipt  and  distribution  process,  including 
funding  appropriated  by  Congress  for  the  current  fiscal  year  and  related 
apportionment/reapportionment  activity  by  OMB,  as  well  as  allotment  and 
suballotment  activity  within  the  department.15 

Wave  2 — Statement  of  Budgetary  Resources  (SBR)  Audit  focuses 
efforts  on  assessing  and  strengthening,  as  necessary,  the  internal 
controls,  processes,  and  business  systems  supporting  the  budgetary- 
related  data  (e.g.,  status  of  funds  received,  obligated,  and  expended) 
used  for  management  decision  making  and  reporting,  including  the  SBR. 
In  addition  to  fund  balance  with  Treasury  reporting  and  reconciliation, 


15  The  Antideficiency  Act  generally  requires  that  all  appropriations  to  DOD  be  apportioned 
by  the  President,  who  has  delegated  this  authority  to  OMB,  and  that  all  appropriations, 
apportionments,  and  re-apportionments  be  controlled  by  DOD  through  an  OMB-approved 
system  of  funds  control  under  which  DOD  makes  allotments  or  further  subdivisions  of 
apportionments,  such  as  suballotments.  See  31  U.S.C.  §§  1513,  1514. 
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significant  end-to-end  business  processes  in  this  wave  include  procure- 
to-pay,  hire-to-retire,  order-to-cash,  and  budget-to-report. 

Wave  3 — Mission-Critical  Assets  Existence  and  Completeness  Audit 

focuses  efforts  on  assessing  and  strengthening,  as  necessary,  internal 
controls  and  business  systems  involved  in  ensuring  that  all  assets 
(including  military  equipment,  general  equipment,  real  property,  inventory, 
and  operating  materials  and  supplies)  are  recorded  in  the  department’s 
accountable  property  systems  of  record,  all  of  the  reporting  entities’ 
assets  are  recorded  in  those  systems  of  record,  reporting  entities  have 
the  right  (ownership)  to  report  these  assets,  and  the  assets  are 
consistently  categorized,  summarized,  and  reported. 

Wave  4 — Full  Audit  Except  for  Legacy  Asset  Valuation  focuses  efforts 
on  assessing  and  strengthening,  as  necessary,  internal  controls, 
processes,  and  business  systems  involved  in  the  proprietary  side  of 
budgetary  transactions  covered  by  the  Statement  of  Budgetary 
Resources  effort  of  wave  2,  including  accounts  receivable,  revenue, 
accounts  payable,  expenses,  environmental  liabilities,  and  other  liabilities. 
This  wave  also  includes  efforts  to  support  valuation  and  reporting  of  new 
asset  acquisitions. 

Wave  5 — Full  Financial  Statement  Audit  focuses  efforts  on  assessing 
and  strengthening,  as  necessary,  processes,  internal  controls,  and 
business  systems  involved  in  supporting  the  valuations  reported  for 
legacy  assets  once  efforts  to  ensure  controls  over  the  valuation  of  new 
assets  acquired  and  the  existence  and  completeness  of  all  mission 
assets  are  deemed  effective  on  a  go-forward  basis.  Given  the  lack  of 
documentation  to  support  the  values  of  the  department’s  legacy  assets, 
federal  accounting  standards  allow  for  the  use  of  alternative  methods  to 
provide  reasonable  estimates  for  the  cost  of  these  assets. 

To  guide  the  components  in  executing  the  strategy,  the  FIAR  Guidance 
provides  a  set  of  mandatory,  standardized  phases  and  steps  that  the 
components  must  follow  to  develop  and  implement  their  FIPs  to  achieve 
audit  readiness.  This  step-by-step  methodology  delineates  FIP 
responsibilities  between  the  components’  management  and  the  auditors. 
For  each  assessable  unit,  management’s  responsibilities  focus  on 
identifying,  implementing,  and  documenting  necessary  financial 
management  improvements  during  the  first  four  phases  of  the  FIAR 
Methodology,  and  sustaining  those  improvements  through  the  fifth  phase. 
For  phases  six  and  seven,  after  the  DOD  Comptroller’s  initial  review  and 
approval  of  a  FIP  supporting  audit  readiness,  the  component  engages  an 
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independent  auditor  to  first  perform  an  examination  of  the  FIP  and  if 
validated,  then  an  audit  of  the  assessable  unit  and  finally,  the  entity’s 
financial  statements. 

After  a  component  concludes  that  an  assessable  unit  is  ready  for  audit,  a 
component  continues  to  maintain  the  FIP  to  document  the  validation  of 
audit  readiness  by  an  independent  auditor  and  the  sustainability  of  audit 
readiness  through  ongoing  efforts  by  the  component.  Throughout  this 
report,  however,  we  use  the  term  “FIP”  to  mean  the  record  of  FIP 
implementation  and  related  documentation  that  was  used  to  support  the 
conclusion  of  audit  readiness  because  that  is  the  point  at  which  we 
reviewed  the  two  selected  FIPs.  In  instances  where  additional 
documentation  was  provided  to  us  later,  we  indicate  that  such  information 
was  provided  subsequent  to  the  audit  readiness  conclusion. 

A  description  of  each  of  the  phases  of  the  FIAR  Methodology  as  set  forth 
in  the  FIAR  Guidance  follows: 

Phase  1  -  Evaluation  and  Discovery:  Management  documents  its 
business  and  financial  environment,  defines  and  prioritizes  its  processes 
into  assessable  units,  assesses  risk  and  tests  controls,  evaluates 
supporting  documentation,  identifies  weaknesses  and  deficiencies,  and 
defines  its  audit  readiness  environment. 

Phase  2  -  Corrective  Action:  Management  develops  and  executes 
corrective  action  plans  that  identify  the  specific  steps  a  reporting  entity  will 
take  to  resolve  deficiencies,  the  resources  required  and  committed,  and 
targeted  milestones  and  completion  dates. 

Phase  3  -  Evaluation:  Management  evaluates  its  corrective  action 
effectiveness  through  testing  and  determines  whether  the  entity  is  ready 
for  audit. 

Phase  4  -  Assertion:  Management  prepares  all  relevant  supporting 
documentation  and  asserts  audit  readiness  to  the  Office  of  the  Under 
Secretary  of  Defense  (Comptroller)  (OUSD(C))  and  the  DOD  OIG. 

Phase  5  -  Sustainment:  Management  maintains  audit  readiness  through 
risk-based  periodic  testing  of  internal  controls  utilizing  the  OMB  Circular 
No.  A-123,  Appendix  A  processes  and  procedures,  and  resolves  any 
identified  weaknesses  in  a  timely  manner. 
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Phase  6  -  Validation:  The  DOD  Comptroller  and  DOD  OIG  conduct  an 
initial  review  of  the  FIP  including  management’s  assertion.  If  the  DOD 
Comptroller  determines  that  management’s  assertion  is  supported  by  the 
FIP,  then  an  independent  auditor  performs  an  examination  for  the  audit 
readiness  assertion. 

Phase  7  -  Audit:  The  component  (reporting  entity)  engages  an 
independent  auditor  and  supports  the  audit  of  the  assessable  unit  or  the 
financial  statements. 

Each  wave  of  the  FIAR  Plan  Strategy  is  comprised  of  numerous 
assessable  units  identified  by  the  components,  and  each  assessable  unit 
must  go  through  the  seven  phases  of  the  FIAR  Methodology.  As  shown  in 
table  2,  the  DOD  military  components  reported  73  assessable  units  for 
waves  1-3  in  the  May  201 1  FIAR  Plan  Status  Report.  No  assessable  units 
had  yet  been  reported  for  waves  4  and  5.  While  our  focus  was  on  the 
military  components,  the  FIAR  Plan  Status  Report  also  provided  general 
information  on  the  status  of  assessable  units  for  other  DOD  components 
for  waves  1-3. 


Table  2:  Reported  Status  of  Military  Component  Assessable  Units  (by  Waves  and  Components) 

Wave  /  component 

Assessable  unit 

Audit  readiness 
phase  (as  of 

May  2011) 

Quarter  asserted,  or 
scheduled  to  assert, 
audit  readiness 

Wave  1 

Army 

Appropriations  Received 

Phase  6 

Q4  FY  2010 

Navy 

Appropriations  Received 

Phase  6 

Q2  FY  2009 

Air  Force 

Appropriations  Received 

Phase  6 

Q4  FY  2010 

Wave  2 

Army 

General  Fund  Enterprise  Business  System  (GFEBS)  -  All 
Waves,  Examination  3 

not  started 

Q1  FY  2013 

GFEBS  -  All  Waves,  Examination  4 

not  started 

Q1  FY  2014 

Civilian  Pay 

Phase  1 

Q1  FY  2015 

Military  Pay 

Phase  1 

Q1  FY  2015 

Net  Outlays  (including  Fund  Balance  With  Treasury) 

Phase  1 

Q1  FY  2015 

Obligations  -  Contracts 

Phase  1/Phase  2 

Q1  FY  2015 

Obligations  -  Permanent  Change  of  Station 

Phase  1/Phase  2 

Q1  FY  2015 

Obligations  -  Temporary  Duty 

Phase  1/Phase  2 

Q1  FY  2015 

Reimbursable 

Phase  1/Phase  2 

Q1  FY  2015 

GFEBS  -  Waves  1  &  2,  Examination  2 

Phase  2 

Q2  FY  2012 
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Wave  /  component 

Assessable  unit 

Audit  readiness 
phase  (as  of 

May  2011) 

Quarter  asserted,  or 
scheduled  to  assert, 
audit  readiness 

Financial  Statement  Compilation  and  Reporting 

Phase  2 

Q1  FY  2015 

GFEBS  -  Wave  1,  Examination  1 

Phase  6 

Q2  FY  2011 

Navy 

Civilian  Pay 

Phase  2 

Q2  FY  201 0a 

Transportation  of  People 

Phase  2 

Q4  FY  201 0b 

Examination  of  One  Acquisition  Program 

Phase  2 

Q4  FY  2011 

Examination  of  One  Navy  Enterprise  Resource  Planning 
Entity 

Phase  2 

Q4  FY  2012 

Financial  Statement  Compilation  and  Reporting 

Phase  2 

Q4  FY  2012 

Military  Pay 

Phase  2 

Q4  FY  2012 

Net  Outlays  (including  Fund  Balance  With  Treasury) 

Phase  2 

Q4  FY  2012 

Complete  Statement  of  Budgetary  Resources 

Phase  2 

Q1  FY  2013 

MILSTRIP  Orders 

Phase  4 

Q3  FY  2011 

Reimbursable  Authority 

Phase  4 

Q3  FY  2011 

Reimbursable  Work  Orders  -  Grantor 

Phase  4 

Q3  FY  2011 

Air  Force 

Examination  of  Defense  Enterprise  Accounting  and 
Management  System  at  TRANSCOM/Scott  AFB 

Phase  1 

Q4  FY  2012 

Examination  of  One  Acquisition  Program 

Phase  1 

Q4  FY  2012 

Reimbursable  Authority 

Phase  1 

Q1  FY  2013 

Civilian  Pay 

Phase  1 

Q4  FY  2015 

Contracts 

Phase  1 

Q4  FY  2015 

Financial  Statement  Compilation  and  Reporting 

Phase  1 

Q4  FY  2015 

Net  Outlays  (including  Fund  Balance  With  Treasury) 

Phase  1 

Q4  FY  2015 

Plan  to  Stock  Transactions  (Operating  Materials  and 
Supplies) 

Phase  1 

Q4  FY  2015 

Procure  to  Pay  Transactions  (non-acquire-to-retire) 

Phase  1 

Q4  FY  2015 

Reimbursements 

Phase  1 

Q4  FY  2015 

Military  Pay 

Phase  1 

Q1  FY  2017 

Complete  Statement  of  Budgetary  Resources 

Phase  1 

Q1  FY  2017 

Funds  Distribution  to  Base 

Phase  2 

Q1  FY  2012 

Fund  Balance  With  Treasury  Reconciliation 

Phase  6 

Q1  FY  201 1 

Non-expenditure  Transfers 

Phase  6 

Q4  FY  2010 

Rescissions 

Phase  6 

Q4  FY  2010 

Wave  3 

Army 

General  Equipment  -  Remainder 

Phase  1 

Q4  FY  2014 

Inventory 

Phase  1 

Q3  FY  2015 

Military  Equipment  -  Remainder 

Phase  1 

Q1  FY  2015 

Operating  Materials  and  Supplies 

Phase  1 

Q3  FY  2015 
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Wave  /  component 

Assessable  unit 

Audit  readiness 
phase  (as  of 

May  2011) 

Quarter  asserted,  or 
scheduled  to  assert, 
audit  readiness 

Real  Property 

Phase  2 

Q1  FY2013 

General  Equipment  -  Fire  &  Rescue 

Phase  6 

Q2  FY  2011 

Military  Equipment  -  8  asset  types 

Phase  6 

Q2  FY  2011 

Navy 

Military  Equipment  -  Remainder 

Phase  2 

Q4  FY  2013 

Military  Equipment  -  U.S.  Marine  Corps 

Phase  2 

Q4  FY  2013 

General  Equipment 

Phase  2 

Q4  FY  2014 

General  Equipment  -  U.S.  Marine  Corps 

Phase  2 

Q4  FY  2014 

Inventory  -  Navy 

Phase  2 

Q1  FY  2014 

Inventory  -  U.S.  Marine  Corps 

Phase  2 

Q1  FY  2014 

Real  Property  -  Navy 

Phase  2 

Q2  FY  2014 

Real  Property  -  U.S.  Marine  Corps 

Phase  2 

Q2  FY  2014 

Operating  Materials  and  Supplies  -  Remainder 

Phase  2 

Q2  FY  2015 

Operating  Materials  and  Supplies  -  U.S.  Marine  Corps 

Phase  2 

Q2  FY  2015 

Military  Equipment  -  Aircraft 

Phase  5  or  7 

Q4  FY  2010 

Military  Equipment  -  Intercontinental  Ballistic  Missiles 

Phase  5  or  7 

Q4  FY  2010 

Military  Equipment  -  Satellites 

Phase  5  or  7 

Q4  FY  2010 

Military  Equipment  -  Ships 

Phase  5  or  7 

Q4  FY  2010 

Operating  Materials  and  Supplies  -  Ordnance 

Phase  5  or  7 

Q4  FY  2010 

Air  Force 

General  Equipment 

Phase  1 

Q4  FY  2016 

Real  Property 

Phase  2 

Q3  FY  2013 

Inventory 

Phase  2 

Q4  FY  2015 

Operating  Materials  and  Supplies  -  Remainder 

Phase  2 

Q4  FY  2016 

Operating  Materials  and  Supplies  -  Cruise  Missiles  & 
Drones 

Phase  4 

Q3  FY  2011 

Operating  Materials  and  Supplies  -  Missile  Motors 

Phase  4 

Q3  FY  2011 

Operating  Materials  and  Supplies  -  Spare  Engines 

Phase  4 

Q3  FY  2011 

Military  Equipment 

Phase  6 

Q1  FY  201 1 

Source:  FIAR  Plan  Status  Report,  May  2011 

aAssessable  unit  is  scheduled  to  re-assert  audit  readiness  in  Q2  FY  2012. 

bAssessable  unit  is  scheduled  to  re-assert  audit  readiness  in  Q1  FY  2013. 

The  May  2010  FIAR  Guidance  provides  a  reasonable  methodology  for 
the  DOD  components  to  use  to  develop  and  implement  their  FIPs.  It 
details  the  roles  and  responsibilities  of  the  DOD  components,  and 
prescribes  a  standard,  systematic  process  components  should  follow  to 
assess  processes,  controls,  and  systems,  and  identify  and  correct 
weaknesses  in  order  to  achieve  auditability.  The  FIAR  Guidance  requires 


FIAR  Guidance 
Provides  a 
Reasonable 
Methodology 
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components  to  fully  document  the  procedures  carried  out  as  they 
implement  the  FIPs,  and  the  results,  which  will  allow  for  an  independent 
assessment  of  audit  readiness.  Overall,  the  procedures  required  by  the 
FIAR  Guidance  are  consistent  with  selected  procedures  for  conducting 
financial  statement  audits,  such  as  reconciling  the  population  of 
transactions  to  be  tested,  conducting  tests  of  information  systems 
controls,  and  conducting  internal  control  and  substantive  testing.16  The 
FIAR  Guidance  also  requires  the  components  to  correct  the  deficiencies 
identified  during  testing  and  document  the  results,  which  is  consistent 
with  federal  internal  control  standards  and  OMB  guidance.17  While  the 
audit  strategy  for  waves  4  and  5  has  not  been  completely  defined  yet,  the 
same  overall  FIAR  Methodology  will  likely  apply  to  these  waves  as  well. 
DOD’s  ability  to  achieve  audit  readiness  is  highly  dependent  on  the 
components’  ability  to  effectively  develop  and  implement  FIPs  in 
compliance  with  the  FIAR  Guidance. 

The  DOD  Comptroller  has  identified  critical  elements  of  financial  reporting 
which  DOD  components  are  expected  to  carry  out  during  phases  1 
through  3  of  the  FIAR  Methodology  and  which  closely  align  with 
procedures  that  are  performed  during  an  audit.  Following  are  more  details 
about  some  of  the  critical  elements  required  by  the  FIAR  Guidance. 

Internal  control  and  substantive  testing.  DOD  components  are 
required  to  perform  both  internal  control  and  substantive  testing  as  part  of 
the  process  to  assess  audit  readiness.  Internal  control  tests  are 
performed  to  obtain  evidence  about  the  achievement  of  specific  control 
objectives,  while  substantive  tests  are  performed  to  obtain  evidence  on 
whether  amounts  reported  on  the  financial  statements  are  reliable.  Both 
types  of  testing  generally  involve  determining  whether  appropriate 
supporting  documentation  exists  and  is  readily  available.  Internal  control 
testing  focuses  on  assessing  the  effectiveness  of  controls  that  would 
prevent  or  detect  potential  misstatements  in  the  financial  statements.  For 
example,  to  test  controls  over  operating  expenses,  a  component  would 
review  a  sample  of  invoices  to  determine  if  they  had  been  properly 


16  Substantive  tests  are  performed  to  obtain  evidence  on  whether  amounts  reported  on 
the  financial  statements  are  reliable. 

17  GAO,  Standards  for  Internal  Control  in  the  Federal  Government, 
GAO/AIMD-OO-21.3.1  (Washington,  D.C.:  November  1999);  and  OMB  Circular  No.  A- 
123,  Appendix  A,  Internal  Control  Over  Financial  Reporting. 
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approved  for  payment,  typically  indicated  by  a  signature  of  an  authorized 
official.  Substantive  testing,  on  the  other  hand,  is  conducted  to  obtain 
evidence  on  whether  the  amounts  reported  on  the  financial  statements 
are  reliable.  For  example,  to  test  an  operating  expense  balance,  a 
component’s  procedures  would  include  examining  invoices  to  determine  if 
the  amounts  of  the  invoices  matched  the  transaction  amounts  recorded  in 
the  general  ledger  and  determining  if  the  purchased  item  or  service  was 
actually  received.  As  discussed  below,  a  key  step  in  testing  involves 
reconciling  the  population  of  transactions  to  be  tested. 

Reconciliation  of  population  of  transactions.  To  conduct  both  internal 
control  and  substantive  testing,  a  sample  of  the  data  transactions  is 
typically  selected  for  testing.  An  organization  must  ensure  that  a  sample 
is  taken  from,  or  represents,  the  complete  population  of  transactions  that 
needs  to  be  tested.  According  to  the  FIAR  Guidance,  to  ensure  the 
completeness  of  the  population,  the  DOD  components  are  required  to 
identify  the  population  of  transactions  for  an  assessable  unit,  compare  the 
total  amount  of  those  transactions  to  the  amounts  recorded  in  the  general 
ledger18  and  the  financial  statements,  and  then  research  and  resolve  any 
differences  between  the  amounts  prior  to  selecting  a  sample. 

Tests  of  information  systems  controls.  Because  most  financial 
information  is  maintained  in  computer  systems,  the  controls  over  how 
those  systems  operate  are  integral  to  the  reliability  of  financial  data.  The 
components  are  required  to  identify,  document,  and  test  both  general  and 
application  controls  for  key  systems  that  process  transactions.  General 
controls  are  the  policies  and  procedures  that  apply  to  all  or  a  large 
segment  of  an  entity’s  information  systems  and  help  ensure  their  proper 
operation.  The  objectives  of  general  controls  include  safeguarding  data, 
protecting  application  programs,  and  ensuring  continued  computer 
operations  in  case  of  unexpected  interruptions.  For  example,  general 
controls  include  logical  access  controls  that  prevent  or  detect 
unauthorized  access  to  sensitive  data  and  programs  that  are  stored, 
processed,  and  transmitted  electronically.  Application  controls, 
sometimes  referred  to  as  business  controls,  are  incorporated  directly  into 
computer  applications  to  help  ensure  the  validity,  completeness, 


1  ft 

A  general  ledger  is  a  book  or  financial  information  system  of  final  entry  summarizing  all 
financial  transactions  from  books  of  original  entry  (e.g.,  a  payroll  system).  It  contains  a 
collection  of  all  asset,  liability,  equity,  revenue,  and  expense  accounts,  and  is  the  final 
record  from  which  financial  statements  are  prepared. 
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accuracy,  and  confidentiality  of  data  during  application  processing  and 
reporting.  For  example,  a  system  edit  used  to  prevent  or  detect  a 
duplicate  entry  is  an  application  control. 

Corrective  action  plans.  The  components  are  required  to  develop  and 
execute  corrective  action  plans  to  remediate  any  deficiencies  that  indicate 
that  controls  are  not  working  and/or  transaction  amounts  are  not 
supported.  The  corrective  action  plans  should  include  the  solutions  to  be 
implemented  to  resolve  the  deficiencies,  the  identification  of  resources 
required  and  committed  to  carry  out  the  solutions,  and  the  targeted 
milestones  and  completion  dates.  Further,  the  FIAR  Guidance  states  that 
after  corrective  actions  have  been  taken,  the  components  should  perform 
additional  testing  to  determine  whether  the  deficiencies  were  in  fact 
remediated. 


Navy  Civilian  Pay  and 
Air  Force  Military 
Equipment  FIPs  Were 
Not  Adequately 
Developed  and 
Implemented 


The  Navy  and  Air  Force  did  not  adequately  develop  and  implement  their 
respective  FIPs  for  Civilian  Pay  and  Military  Equipment  in  accordance 
with  the  FIAR  Guidance.  Our  review  of  these  FIPs  found  similar 
deficiencies  in  both  of  them.  Specifically,  our  review  of  the  FIPs  found  that 
the  Navy  and  Air  Force  did  not  conduct  sufficient  control  and  substantive 
testing,  and  reached  conclusions  that  were  not  supported  by  the  testing 
results,  did  not  complete  reconciliations  of  the  population  of  transactions, 
and  did  not  fully  test  information  systems  controls.  Also,  neither 
component  had  fully  developed  and  implemented  corrective  action  plans 
to  address  deficiencies  identified  during  implementation  of  the  FIPs.  In 
addition,  the  Navy  did  not  accurately  report  the  status  of  certain  metrics  in 
the  November  2010  FIAR  Plan  Status  Report.  As  a  result  of  these 
deficiencies,  neither  FIP  provided  sufficient  support  for  the  components’ 
conclusions  that  the  assessable  units  were  ready  to  be  audited.  Navy 
officials  stated  that  they  were  taking  action  to  address  the  issues 
identified  and  planned  to  submit  a  revised  FIP  by  March  2012.  Air  Force 
officials  also  indicated  that  they  were  taking  action  to  address  the  issues 
identified.  In  July  201 1 ,  Air  Force  officials  provided  updates  on  the  status 
of  several  actions  that  were  underway  or  completed  but,  for  the  most  part, 
did  not  provide  supporting  documentation  for  our  review.  Further,  the 
actions  they  identified  did  not  address  all  of  the  deficiencies  that  we 
noted. 
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The  Navy  did  not  adequately  develop  and  implement  its  FIP  for  civilian 
pay  in  accordance  with  the  FIAR  Guidance.  Specifically,  our  review  of  this 
FIP  found  that  the  Navy  did  not  (1)  conduct  sufficient  control  and 
substantive  testing,  and  reached  conclusions  that  were  not  supported  by 
the  testing  results;  (2)  reconcile  the  population  of  transactions  recorded  in 
the  payroll  system  to  those  in  the  general  ledger  prior  to  testing;  (3)  fully 
test  information  systems  controls;  (4)  adequately  develop  and  implement 
corrective  action  plans;  and  (5)  accurately  assess  and  report  the  status  of 
its  FIP  work  in  terms  of  specific  FIAR  Plan  metrics.  As  such,  the  FIP 
documentation  did  not  support  audit  readiness  for  civilian  pay  as  asserted 
by  the  Navy  on  March  31,  2010. 

Both  the  DOD  Comptroller  and  the  DOD  OIG  found  many  of  the  same 
issues  that  we  did  during  their  reviews  of  the  FIP.  Navy  officials  said  that 
they  are  performing  additional  analysis  and  testing  to  address  identified 
deficiencies  and  plan  to  submit  a  revised  FIP  by  March  2012. 

The  following  paragraphs  provide  more  details  about  the  deficiencies  we 
found  in  the  Navy’s  Civilian  Pay  FIP. 

Testing  Was  Insufficient  and  Did  Not  Support  Conclusions.  The  Navy 
did  not  conduct  sufficient  internal  control  and  substantive  testing  for 
civilian  pay,  as  required  by  the  FIAR  Guidance.  We  found  instances  in 
which  documentation  of  the  Navy’s  testing  results  was  not  included  in  the 
FIP  and  other  instances  in  which  the  documentation  was  included  but  did 
not  support  the  conclusion  reached.  For  example,  while  the  Navy 
concluded  that  internal  controls  were  designed  and  operating  effectively, 
the  results  of  the  control  testing  indicated  that  9  of  17  controls  tested  were 
ineffective.  The  Navy  reported  that  its  civilian  pay  was  ready  for  audit 
because  its  control  environment19  mitigated  the  deficiencies  of  its 
ineffective  controls;  however,  it  did  not  explain  how  this  was 
accomplished.  Based  on  our  analysis  and  discussions  with  Navy  officials, 
we  determined  the  control  environment  did  not  mitigate  these 
deficiencies.  Both  the  DOD  Comptroller  and  OIG  had  similar  comments 
about  the  control  environment.  In  addition,  the  Navy  concluded  that 
system  exception  and  change  reports,  which  are  computerized  input  and 


Navy’s  Civilian  Pay  FIP 
Was  Not  Adequately 
Developed  and 
Implemented 


1 Q 

The  control  environment  refers  to  the  discipline,  structure,  and  climate  throughout  an 
organization  that  sets  an  attitude  toward  internal  control  and  conscientious  management. 
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edit  controls  in  the  form  of  reports,20  were  in  general  operating  effectively. 
However,  the  detailed  test  results  showed  that  5  of  14  reports  would  not 
always  run  properly,  and  that  one  report  was  in  fact  not  running  properly 
as  it  was  producing  false  positives  and  negatives  (i.e.,  information  that 
was  not  always  accurate). 

The  FIP  indicated  that  no  exceptions  were  identified  as  a  result  of  the 
substantive  testing  performed.  However,  during  our  review  of  the  testing 
results,  we  identified  substantive  exceptions.  For  example,  the  Navy  was 
unable  to  verify  the  reasonableness  of  payroll  amounts  for  a  sample  of 
employees  because  of  incomplete  and  missing  documentation,  such  as 
time  and  attendance  reports  and  schedules  with  approved  pay  rates. 

Navy  officials  said  that  they  did  not  pursue  the  missing  documents 
because  the  related  control  test  for  this  process  had  failed;  therefore,  they 
did  not  believe  the  substantive  test  needed  to  be  completed  nor  did  they 
consider  the  incomplete  or  missing  documents  to  be  substantive 
exceptions.  Navy  officials  said  that  they  later  tested  payroll  transactions 
for  another  sample  of  employees,  but  did  not  retain  the  documentation 
because  it  contained  personally  identifiable  information  (e.g.,  social 
security  numbers).  The  officials  also  said  that  they  are  performing 
additional  substantive  testing  and  will  include  that  documentation  in  the 
revised  FIP. 

In  addition,  there  was  no  evidence  in  the  FIP  that  control  and  substantive 
tests  were  performed  for  personnel  benefits  (e.g.,  payments  for  retirement 
plans  and  health  insurance).  Navy  officials  said  that  they  had  performed 
testing  of  personnel  benefits,  but  that  they  did  not  retain  the 
documentation  as  it  contained  personally  identifiable  information. 
However,  as  stated  earlier,  the  FIAR  Guidance  requires  that  all  FIP 
procedures  and  the  results  be  fully  documented.  The  officials  also  said 
that  the  additional  payroll  testing  that  they  are  performing  includes 
personnel  benefits,  and  that  this  will  be  documented  in  the  revised  FIP. 

Population  of  Transactions  Was  Not  Reconciled.  The  Navy  did  not 
reconcile  the  population  of  transactions  for  civilian  pay  prior  to  conducting 
testing  as  required  by  the  FIAR  Guidance. 


on 

Exception  and  change  reports  are  designed  to  provide  reasonable  assurance  that  data 
received  for  computer  processing  have  been  properly  authorized  and  converted  into 
machine  sensible  form,  and  that  the  data  have  not  been  lost,  suppressed,  added, 
duplicated,  or  improperly  changed. 
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Specifically,  the  Navy  did  not  ensure  that  it  selected  samples  from  the 
complete  population  of  payroll  transactions  recorded  in  the  Defense 
Civilian  Pay  System  (DCPS)21  because  it  did  not  reconcile  all  DCPS  data 
to  the  Navy’s  general  ledger  systems.22  Instead,  it  used  a  subset  of  the 
payroll  transactions  to  conduct  a  reconciliation.  The  Navy  stated  that  the 
transactions  excluded  from  the  reconciliation  were  immaterial  but  the 
rationale  and  support  for  this  conclusion  was  not  documented  in  the  FIP 
at  the  time  the  Navy  concluded  that  civilian  pay  was  audit-ready.  In 
addition,  the  Navy  identified  discrepancies  during  its  efforts  but  did  not 
clearly  document  what  these  discrepancies  were  or  their  resolution.  For 
example,  the  Navy  documented  in  the  FIP  that  there  were  instances  of 
missing  data  and  high  variances,  but  did  not  indicate  the  nature  of  these 
issues  or  how  pervasive  they  were,  the  actions  taken  to  resolve  them, 
and/or  whether  the  issues  were  resolved.  In  response  to  these  concerns 
we  raised,  Navy  officials  said  that  they  subsequently  performed  a 
reconciliation  using  more  recent  payroll  transactions  that  resulted  in 
insignificant  unreconciled  discrepancies.  The  officials  stated  that  they 
believed  these  results  were  sufficient  to  ensure  that  a  complete 
population  was  identified  and  that  they  used  this  population  to  select  a 
sample  of  transactions  and  are  performing  detailed  testing.  Navy  officials 
said  that  the  results  of  this  work  will  be  included  in  the  revised  FIP. 

In  addition,  the  Navy  documented  in  the  FIP  that  it  was  unable  to 
reconcile  the  payroll  accounts  in  its  general  ledgers  to  the  DOD-wide 
general  ledger  that  is  used  to  generate  the  components’  and 
department’s  financial  statements.  In  their  attempt  to  perform  this 
reconciliation,  Navy  officials  noted  that  they  were  unable  to  extract 
reliable  payroll  data  from  the  DOD-wide  general  ledger  and  that  the 
payroll  account  balance  in  the  DOD-wide  general  ledger  was  greater  than 
the  total  of  the  account  balances  in  the  Navy’s  general  ledgers.  As  a 
result,  the  Navy  was  unable  to  reconcile  the  population  of  payroll 
transactions  to  the  system  that  ultimately  produces  its  financial 
statements;  in  other  words,  it  could  not  identify  the  information  needed  to 
test  the  civilian  pay  amounts  included  in  the  financial  statements.  The 


21  DCPS  is  a  DOD-wide  payroll  system  that  is  managed  by  the  Defense  Finance  and 
Accounting  Service  (DFAS). 

22  Navy’s  general  ledger  systems  include  the  Standard  Accounting  and  Reporting  System 
-  Field  Level  (STARS-FL),  the  Standard  Accounting  and  Reporting  System  - 
Headquarters  Claimant  Module  (STARS-HCM),  the  Navy  Enterprise  Resource  Planning 
(ERP),  and  the  Standard  Accounting,  Budgeting,  and  Reporting  System  (SABRS). 
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Navy  officials  stated  they  plan  to  address  these  issues  as  part  of  the  SBR 
Financial  Statement  Compilation  and  Reporting  assessable  unit,  which 
they  plan  to  have  audit-ready  by  the  end  of  fiscal  year  2012. 

Information  Systems  Controls  Were  Not  Fully  Tested.  The  FIAR 
Guidance  requires  DOD  components  to  test  system  controls  to  ensure 
that  they  are  operating  as  intended.  However,  the  methodology — the 
Defense  Information  Assurance  Certification  and  Accreditation  Process 
(DIACAP) — that  the  Navy  used  to  assess  information  systems  controls 
did  not  address  all  the  elements  of  a  general  controls  assessment.  For 
example,  the  DIACAP  did  not  address  the  periodic  review  of  (1)  users’ 
access  authorizations  or  privileges  to  ensure  that  they  are  appropriate 
based  on  assigned  roles  and  responsibilities,  and  (2)  automated  logs  of 
changes  to  security  access  authorizations  to  ensure  that  management  is 
aware  of  any  unusual  activity.  In  addition,  the  Navy  did  not  review  the 
results  of  general  controls  assessments  to  ensure  that  the  assessments 
covered  the  overall  operating  environment  in  which  the  systems  operated. 
For  example,  any  general  control  weaknesses  in  a  mainframe  or  network 
that  were  not  included  in  the  scope  of  the  assessment  could  possibly 
negate  the  effectiveness  of  the  controls  for  the  individual  system 
reviewed.  Because  the  Navy  did  not  include  all  elements  of  a  general 
controls  assessment  in  its  testing,  it  was  unable  to  demonstrate  the 
effectiveness  of  the  Navy’s  overall  general  control  environment. 

The  Navy  reported  in  the  FIP  that  it  relied  on  a  SAS  70  report23  to  obtain 
assurance  over  key  payroll  processing  controls  (i.e. ,  application  controls) 
for  the  DCPS.  However,  that  report  identified  significant  weaknesses. 
Specifically,  it  indicated  that  several  control  activities  were  found  to  be 
ineffective  and  as  a  result,  certain  control  objectives  were  not  met  for 
DCPS.24  In  the  FIP,  the  Navy  stated  that  the  particular  control  activities 
identified  as  ineffective  in  the  SAS  70  report  did  not  significantly  affect 


oo 

A  SAS  70  report  is  issued  by  an  independent  auditor  and  discusses  the  effectiveness  of 
internal  controls  over  the  processing  of  transactions  by  a  service  organization.  (Statement 
on  Standards  for  Attestation  Engagements  (SSAE)  16  reports  will  replace  the  SAS  70 
reports  for  periods  ending  on  or  after  June  15,  2011.) 

24  Control  activities  are  the  policies,  procedures,  techniques,  and  mechanisms  that 
enforce  management’s  directives  and  accomplish  an  agency’s  control  objectives.  Control 
objectives  are  stated  objectives  that,  if  achieved,  provide  reasonable  assurance  that 
individual  and  aggregate  misstatements  (whether  caused  by  error  or  fraud),  losses,  or 
noncompliance  material  to  the  financial  statements  would  be  prevented  or  detected. 
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Navy  Civilian  Pay,  but  it  did  not  adequately  document  the  rationale  for  this 
assessment.  Nevertheless,  we  determined  that  several  of  these  control 
activities,  and  related  control  objectives,  were  significant  to  Navy  Civilian 
Pay  and,  as  such,  the  Navy  did  not  have  reasonable  assurance  that  its 
personnel  and  payroll  data  were  complete,  accurate,  and  timely 
processed. 

Corrective  Actions  Were  Not  Adequately  Developed  and 
Implemented.  The  Navy’s  FIP  did  not  include  the  information  needed  for 
corrective  action  plans  as  required  by  the  FIAR  Guidance.  For  the  most 
part,  the  FIP  did  not  include  (1)  the  deficiencies  to  be  corrected  (the  root 
cause  of  the  exceptions),  (2)  the  solutions  to  be  implemented  to  resolve 
the  identified  deficiencies,  (3)  the  resources  needed  to  carry  out  those 
solutions,  and  (4)  a  schedule  for  timely  completion  of  corrective  actions. 
Navy  officials  stated  that  they  are  currently  developing  corrective  action 
plans;  however,  their  first  priority  is  to  develop  and  implement  the  revised 
FIP  which  will  include  evidence  of  audit  readiness  based  on  substantive 
procedures  rather  than  reliance  on  internal  controls.  In  effect,  the  Navy 
plans  to  assert  audit  readiness  based  on  its  testing  of  account  balances 
without  addressing  the  identified  internal  control  deficiencies.  However, 
the  development  and  implementation  of  a  corrective  action  plan  to 
address  such  deficiencies  is  a  requisite  for  improving  financial 
management,  which  is  one  of  the  goals  of  the  FIAR  effort. 

FIP  Status  Was  Not  Accurately  Reported.  The  FIAR  Guidance  requires 
the  components  to  report  the  status  of  Key  Control  Objectives  (KCO)  and 
Key  Supporting  Documents  (KSD)  for  their  assessable  units.  However, 
the  status  for  these  metrics  that  the  Navy  reported  in  the  November  2010 
FIAR  Plan  Status  Report  to  demonstrate  audit  readiness  was  not 
supported  by  the  results  of  the  Navy  FIP  work.  For  example, 

•  The  Status  Report  indicated  that  95  percent  of  KCOs  pertaining  to 
Navy  Civilian  Pay  were  found  to  be  effective;  however,  the  Navy’s 
control  testing  results  reflected  mostly  ineffective  internal  controls. 

•  The  Status  Report  indicated  that  100  percent  of  KSDs  related  to  Navy 
Civilian  Pay  (e.g.,  documentation  evidencing  the  operation  of  an 
internal  control  such  as  properly  approved  time  and  attendance 
records)  were  found  to  exist.  However,  as  discussed  earlier,  Navy 
Civilian  Pay  testing  results  indicated  that  incomplete  and  missing 
documentation  was  one  of  the  more  prevalent  findings. 

Navy  officials  said  that  the  differences  we  noted  were  due  to  the  fact  that 
the  KCOs  and  KSDs  required  for  the  FIAR  Plan  did  not  exactly  match  or 
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align  with  the  Navy’s  actual  work.  Therefore,  the  Navy  tried  to  estimate 
the  appropriate  level  of  progress  to  report  for  the  KCOs  and  KSDs  listed 
in  the  FIAR  Plan  based  on  testing  that  it  conducted.  In  the  May  201 1 
FIAR  Plan,  the  Navy  revised  its  reported  progress  for  these  metrics.  For 
example,  instead  of  reporting  that  95  percent  of  KCOs  were  effective,  the 
May  201 1  FIAR  Plan  indicates  that  60  percent  of  KCOs  were  effective  for 
Navy’s  civilian  pay.  We  did  not  assess  the  accuracy  of  these  revised 
metrics. 


Air  Force’s  Military 
Equipment  FIP  Was  Not 
Adequately  Developed  and 
Implemented 


The  Air  Force  did  not  adequately  develop  and  implement  its  FIP  for 
military  equipment  in  accordance  with  the  FIAR  Guidance.  See  table  3  for 
the  types  of  Air  Force  military  equipment,  and  their  reported  quantities 
and  values.  In  our  review  of  this  FIP,  we  found  that  the  Air  Force  did  not 
(1)  conduct  sufficient  control  and  substantive  testing,  and  reached 
conclusions  that  were  not  supported  by  the  testing  results;  (2)  reconcile 
the  population  of  transactions  recorded  in  its  accountable  property  system 
to  the  general  ledger;  (3)  fully  test  information  systems  controls;  and  (4) 
adequately  develop  and  implement  corrective  action  plans.  As  a  result  of 
these  deficiencies,  the  FIP  documentation  did  not  support  the  Air  Force’s 
December  2010  assertion  that  the  military  equipment  assessable  unit  was 
ready  to  be  audited. 


The  DOD  Comptroller  provided  initial  comments  based  on  its  review  of 
the  FIP  which  indicated  that  it  had  found  issues  similar  to  those  we 
identified  and  concluded  that  the  Air  Force  had  not  demonstrated  audit 
readiness  for  its  military  equipment.  In  addition,  the  DOD  OIG  identified 
similar  issues  and  concluded  that  the  Air  Force  had  not  complied  with  the 
FIAR  Guidance  in  developing  and  implementing  this  FIP.  Air  Force 
officials  acknowledged  that  they  had  more  work  to  do  to  address  the 
identified  deficiencies  and  indicated  that  they  planned  to  complete  these 
corrective  actions  by  the  end  of  June  201 1 .  In  July,  the  Air  Force  provided 
updates  on  the  status  of  several  actions  underway  or  completed  but  did 
not  provide  any  supporting  documentation  for  our  review.  Further,  these 
actions  did  not  address  all  of  the  deficiencies  that  we  identified. 
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Table  3:  Air  Force  Military  Equipment  as  of  September  30,  2010 

Asset  type 

Quantity 

Net  book  value 
($  millions) 

Aerospace  Vehicles 

Aircraft 

6,959 

$83,053 

Intercontinental  Ballistic  Missiles  (ICBMf 

450 

4,433 

Remotely  Piloted  Aircraft  (RPA) 

402 

1,200 

Satellites 

75 

848 

Subtotal  -  Aerospace  Vehicles 

7,886 

$89,534 

Podsb 

5,015 

729 

Total  Air  Force  Military  Equipment 

12,901 

$90,262c 

Source:  Air  Force  Military  Equipment  FIP.  (Data  are  unaudited.) 


The  450  ICBMs  is  an  approximation  of  the  actual  number  of  ICBMs,  which  has  been  adjusted  for 
reporting  purposes  because  the  amount  of  these  missiles  reported  in  the  accountable  property 
system  (the  Reliability  and  Maintainability  Information  System)  is  known  to  be  inaccurate.  This  issue 
is  further  explained  later  in  the  report. 

bPods  are  module  electronic  systems  that  are  externally  attached  to  aircraft  to  provide  specific 
capabilities  to  augment  the  aircraft’s  internal  systems,  such  as  electronic  warfare,  targeting, 
reconnaissance,  and  data  collection. 

cDue  to  rounding,  the  total  amount  for  Air  Force  military  equipment  does  not  equal  the  sum  of 
aerospace  vehicles  and  pods. 


The  following  paragraphs  provide  more  details  about  the  deficiencies  we 
found  in  the  Air  Force’s  FIP. 

Testing  Was  Insufficient  and  Did  Not  Support  Conclusions.  As 

described  earlier,  DOD  components  are  required  to  conduct  both  internal 
control  and  substantive  testing  for  each  assessable  unit.  The  Air  Force 
did  not  perform  sufficient  testing  to  support  audit  readiness  for  the 
existence  and  completeness  of  various  types  of  its  military  equipment. 

For  aircraft,  the  Air  Force  judgmentally  selected  five  sites  at  which  to 
perform  the  testing  but  did  not  provide  evidence  that  the  conditions  at 
these  five  sites  were  representative  of  all  Air  Force  locations.  Selecting 
sites  judgmentally  could  be  an  acceptable  method  if  the  Air  Force  could 
demonstrate  that  the  processes  and  controls  at  the  selected  sites  were 
representative  of  all  other  locations  not  tested. 

For  the  other  four  categories  of  military  equipment — ICBMs,  RPAs, 
satellites,  and  pods — the  FIP  did  not  include  any  documentation  of 
internal  control  or  inventory  testing  for  the  existence  and  completeness  of 
these  assets.  Instead,  the  FIP  described  the  routine  monitoring  activities 
over  these  assets  that  are  conducted  for  operational  purposes.  With 
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regard  to  ICBMs,  Air  Force  officials  said  that  the  Air  Force  Audit  Agency 
will  be  performing  inventory  testing  of  ICBMs  in  fiscal  year  201 1 . 

Population  of  Transactions  Was  Not  Reconciled.  The  Air  Force  did  not 
reconcile  the  population  of  transactions  for  military  equipment  prior  to 
conducting  testing  as  required  by  the  FIAR  Guidance.  Specifically,  the  Air 
Force  did  not  ensure  that  it  selected  testing  samples  from  the  complete 
population  of  transactions  because  it  did  not  complete  a  reconciliation  of 
the  military  equipment  data  recorded  in  its  accountable  property  systems 
of  record  to  its  general  ledger.  When  it  compared  the  data  in  these 
systems,  it  found  discrepancies  that  it  did  not  resolve.  For  example,  there 
was  an  unresolved  difference  of  about  $2  billion  that  was  largely 
attributed  to  differences  in  both  the  recorded  costs  and  accumulated 
depreciation  of  satellites.  We  also  found  that  the  FIP  included 
documentation  that  reported  different  balances  for  aerospace  vehicles.  As 
shown  in  table  3,  the  Air  Force  reported  a  net  book  value25  of  $89.5  billion 
for  its  aerospace  vehicles,  which  was  about  $1 1  billion  more  than  the 
balance  used  to  perform  the  reconciliation  to  the  general  ledger.  Air  Force 
officials  said  that  the  balance  for  aerospace  vehicles  shown  in  table  3  is 
inaccurate  and  that  the  balance  used  to  perform  the  reconciliation  is  likely 
more  reasonable;  however,  there  was  no  documentation  in  the  FIP  to 
support  this  statement.  Because  of  the  unresolved  reconciling  items  and 
the  discrepancies  in  the  balances  reported  for  aerospace  vehicles,  the  Air 
Force  does  not  have  assurance  that  the  testing  done  to  determine  audit 
readiness  covered  the  complete  population  of  its  military  equipment. 

Information  Systems  Controls  Were  Not  Fully  Tested.  The  FIAR 
Guidance  requires  DOD  components  to  test  system  controls  to  ensure 
that  they  are  operating  as  intended.  However,  the  FIP  did  not  provide 
support  to  indicate  that  general  and  application  systems  controls  were 
operating  effectively  for  the  two  systems26  that  maintain  accountability  for 
the  Air  Force’s  military  equipment.  For  REMIS,  the  FIP  included 
information  about  the  Air  Force’s  conclusions  regarding  the  effectiveness 
of  specific  controls.  However,  the  FIP  did  not  include  any  evidence  of  the 


25  Net  book  value  equals  the  recorded  acquisition  cost  of  an  asset  minus  its  accumulated 
depreciation. 

26  The  Air  Force  accountable  property  systems  consist  of  the  Reliability  and 
Maintainability  Information  System  (REMIS)  and  the  Reliability,  Availability,  and 
Maintainability  for  pods  (RAMPOD). 
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testing  performed  that  would  allow  for  an  independent  evaluation  of  its 
work.  For  RAMPOD,  the  FIP  included  a  list  of  controls  to  be  tested,  but 
did  not  provide  any  conclusions  or  any  other  evidence  that  any  testing 
had  been  done. 

The  DOD  Comptroller  expressed  concerns  similar  to  ours  and  as  a  result, 
Air  Force  officials  stated  that  they  would  be  performing  additional  testing 
of  general  and  application  controls.  In  July  201 1 ,  Air  Force  officials 
reported  that  this  testing  was  completed  but  they  did  not  provide 
supporting  documentation  for  our  review. 

Corrective  Actions  Were  Not  Adequately  Developed  and 
Implemented.  The  Air  Force  had  not  developed  corrective  action  plans  to 
address  all  of  the  exceptions  identified  during  testing,  and  had  not 
implemented  any  corrective  actions  to  address  these  exceptions  as  of 
December  31 , 201 0,  when  it  submitted  its  FIP,  as  required  by  the  FIAR 
Guidance.  For  example,  in  reviewing  the  status  of  the  corrective  actions, 
we  found  the  following: 

•  Capital  Modifications27 — The  Air  Force’s  testing  determined  that  it  did 
not  have  the  necessary  controls  in  place  to  ensure  that  equipment 
modifications  were  capitalized  when  appropriate.  The  Air  Force’s 
corrective  action  plan  had  identified  the  nature  of  this  deficiency,  the 
solution,  the  required  resources,  and  targeted  milestone.  However, 
the  targeted  milestone  noted  in  the  FIP  was  January  2011 — 1  month 
after  the  Air  Force  had  indicated  that  the  assessable  until  was  audit 
ready.  Air  Force  officials  indicated  that  they  did  not  expect  to  complete 
this  corrective  action  until  December  201 1 . 

•  Accumulated  Depreciation — The  Air  Force’s  initial  testing  identified 
discrepancies  with  the  accumulated  depreciation  balance  reported  in 
REMIS.  The  errors  included  both  over-  and  underdepreciation  of 
assets,  which,  in  some  instances,  resulted  in  accumulated 
depreciation  amounts  in  excess  of  the  acquisition  cost  of  the  assets. 
However,  as  of  the  date  it  indicated  audit  readiness,  the  Air  Force  had 
not  identified  the  cause  of  this  problem,  the  solution,  or  a  time  frame 
for  implementation.  Subsequent  to  indicating  audit  readiness,  the  Air 


27  The  cost  of  a  modification  is  added  to  the  recorded  value  of  the  modified  piece  of 
military  equipment  (i.e. ,  the  cost  is  “capitalized”)  if  the  cost  of  the  modification  is  over 
$100,000  and  the  modification  adds  capability  to  the  weapon  system  or  extends  its  useful 
life  beyond  the  original  useful  life. 
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Force  said  that  it  analyzed  the  issue  further  and  that  it  had  resolved 
the  issue  by  July  201 1 .  However,  based  on  our  review  of 
documentation  provided,  the  Air  Force’s  actions  did  not  fully  address 
this  weakness. 

•  REMIS  ICBM  Records — The  FIP  stated  that  555  complete  ICBMs 
were  recorded  in  REMIS,  but  that  only  approximately  450  complete 
ICBMs  exist  at  any  time.  The  approximately  100  remaining  ICBMs 
pertain  to  unassembled  missile  components  which,  according  to  the 
Air  Force,  should  be  classified  as  operating  materials  and  supplies 
rather  than  military  equipment.  The  FIP  identified  the  solution  needed 
to  address  this  deficiency  and  stated  that  it  must  be  corrected  before 
military  equipment  can  be  ready  for  audit.  However,  Air  Force  officials 
indicated  that  they  did  not  expect  to  complete  this  corrective  action 
until  the  fourth  quarter  of  fiscal  year  201 1 ,  and  that  testing  the 
effectiveness  of  the  corrective  action  would  be  incorporated  into  the 
fiscal  year  2012  testing  efforts. 


FIP  Monitoring  and 
Oversight  Needs 
Improvement 


DOD  and  its  military  components  have  established  senior  executive 
committees  as  well  as  designated  officials  at  the  appropriate  levels  to 
monitor  and  oversee  their  financial  improvement  efforts.  These 
committees  and  individuals  have  also  generally  been  assigned 
appropriate  roles  and  responsibilities.  (Figure  1  depicts  the  key 
organizations  and  positions  involved  in  the  overall  FIP  process  and  table 
4  in  app.  II  outlines  their  roles  and  responsibilities.)  According  to  relevant 
criteria,28  monitoring  should  be  performed  continually  and  includes 
regular  management  and  supervisory  activities  such  as  assigning 
qualified  people  with  the  appropriate  roles  and  responsibilities,  carrying 
out  assigned  oversight  duties,  and  documenting  the  results  of  oversight 
activities.  We  found  that  Navy  and  Air  Force  officials  as  well  as  oversight 
committees  did  not  effectively  carry  out  their  monitoring  responsibilities 
for  the  FIPs  that  we  reviewed.  However,  once  the  components  indicated 
audit  readiness,  we  found  that  the  DOD  OIG  and  the  DOD  Comptroller 
appropriately  carried  out  their  responsibilities  for  reviewing  the  FIPs. 


pQ 

GAO  and  the  President’s  Council  on  Integrity  and  Efficiency  (PCIE),  Financial  Audit 
Manual  (FAM);  Standards  for  Internal  Control  in  the  Federal  Government, 
GAO/AIMD-OO-21.3.1  (Washington,  D.C.:  November  1999);  OMB  Circular  No.  A-123, 
Management’s  Responsibility  for  Internal  Control  (revised  December  2004);  Committee  of 
Sponsoring  Organizations  of  the  Treadway  Commission,  Internal  Control  -Integrated 
Framework,  Guidance  on  Monitoring  Internal  Control  Systems  (January  2009). 
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Figure  1:  FIP  Oversight  Hierarchy 


Source:  GAO  analysis  of  DOD  data. 


Based  on  our  reviews  of  the  Navy  Civilian  Pay  and  Air  Force  Military 
Equipment  FIPs  discussed  earlier,  the  Navy  and  Air  Force  officials 
responsible  for  monitoring  and  oversight  did  not  effectively  ensure  that 
the  FIP  work  was  performed  in  accordance  with  the  FIAR  Guidance.  The 
FIP  Directors  did  not  ensure  that  their  respective  FIPs  provided  sufficient 
evidence  to  support  the  conclusions  of  audit  readiness  before  providing 
the  FIPs  to  the  Assistant  Secretaries — Financial  Management  and 
Comptroller  (FM&C)  for  their  signature.  Neither  Assistant  Secretary 
ensured  that  the  FIPs  were  sufficient  before  signing  them  to  indicate  audit 
readiness.  For  example,  the  Air  Force’s  FIP  was  signed  even  though  the 
FIP  stated  that  the  deficiency  in  ICBM  reporting,  as  discussed  earlier, 
“must  be  addressed  before  the  military  equipment  line  item  can  be  ready 
for  audit.” 

In  addition,  committees  at  both  the  component  and  DOD  levels  did  not 
effectively  carry  out  their  responsibilities  for  FIP  oversight.  Minutes  of  the 
components’  senior  executive  committee  meetings  did  not  indicate  that 
these  committees  thoroughly  reviewed  the  progress  of  the  FIPs  in 
addressing  financial  management  weaknesses.  With  respect  to  the  FIPs 


Page  26 


GAO-1 1-851  DOD  Financial  Management 


that  we  reviewed,  the  FIAR  Governance  Board’s29  activities  consisted 
primarily  of  receiving  status  update  briefings.  Because  neither  the 
individual  FIP  managers  nor  the  oversight  committees  adequately 
reviewed  and  monitored  the  FIPs,  each  of  the  assessable  units  we 
reviewed  was  deemed  audit-ready  even  though  the  results  did  not 
support  these  conclusions. 

Once  the  components  indicated  audit  readiness,  both  the  DOD  OIG  and 
the  DOD  Comptroller  carried  out  their  responsibilities  for  reviewing  the 
FIPs.  The  DOD  OIG,  which  reviews  FIPs  concurrently  with  the  DOD 
Comptroller  after  a  component  indicates  audit  readiness,  provided 
comments  to  the  DOD  Comptroller  on  each  of  the  FIPs.  It  identified  many 
of  the  same,  or  similar,  issues  that  we  did,  as  discussed  earlier,  and 
concluded  that  the  FIPs  did  not  comply  with  the  FIAR  Guidance  nor 
demonstrate  audit  readiness  for  the  assessable  units. 

The  DOD  Comptroller,  which  makes  the  final  determination  as  to  whether 
an  assessable  unit  is  ready  for  audit,  also  identified  issues  for  the  Navy 
Civilian  Pay  FIP  similar  to  those  discussed  earlier  and  concluded  that  the 
Navy  had  not  demonstrated  audit  readiness  for  its  civilian  pay.  For  the  Air 
Force  Military  Equipment  FIP,  the  DOD  Comptroller  provided  initial 
comments  indicating  that  it  had  found  issues  similar  to  those  we  identified 
and  concluded  that  the  Air  Force  had  not  demonstrated  audit  readiness 
for  its  military  equipment,  but  it  had  not  yet  issued  final  comments. 

Recognizing  that  additional  actions  were  needed  to  assist  the 
components  in  developing  and  implementing  their  FIPS,  the  DOD 
Comptroller  established  a  quality  assurance  team  in  January  201 1  to 
review  the  components’  FIPs  as  they  are  being  developed  and 
implemented.  The  intent  is  for  the  quality  assurance  team  to  provide 
detailed  feedback  on  the  FIPs  before  they  are  formally  submitted  for 
review  and  validation.  In  addition,  the  DOD  Comptroller  developed  a 
series  of  training  courses  to  help  component  personnel  understand  and 
execute  the  FIAR  Methodology.  Officials  from  the  DOD  Comptroller’s 
Office  said  that  the  components  need  additional  training  and  assistance 
with  their  FIPs  because  they  do  not  necessarily  have  staff  with  the 
appropriate  skills  and  qualifications  to  adequately  carry  out  the 


pq 

The  FIAR  Governance  Board  is  co-chaired  by  the  DOD  Comptroller  and  the  DOD 
Deputy  Chief  Management  Officer. 
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procedures  required  by  the  FIAR  Guidance.  We  believe  that  the  DOD 
Comptroller’s  efforts  to  review  the  FIPs  as  they  are  being  developed  and 
implemented,  and  to  provide  additional  training  and  ongoing  feedback, 
will  improve  the  FIPs  and  thus,  the  components’  ability  to  demonstrate 
that  assessable  units  are  audit-ready. 

When  the  components  report  the  progress  of  their  FIPs  inaccurately  and 
submit  FIPs  to  DOD  that  do  not  adequately  support  audit  readiness, 

DOD — both  the  Comptroller  and  the  OIG — must  use  resources  to  review 
unreliable  or  incomplete  information,  and  components  must  then  perform 
rework  to  reach  audit  readiness.  Thus,  the  lack  of  adequate  oversight 
results  in  an  inefficient  FIP  process  and  can  impact  the  ability  of 
components  to  meet  established  milestones. 


Conclusions 


DOD’s  FIAR  Guidance  provides  a  reasonable  and  systematic  process 
that  DOD  components  can  follow  in  their  efforts  to  achieve  audit 
readiness.  It  establishes  clear  priorities  for  the  components  and  a  road 
map  for  reaching  auditability  for  each  assessable  unit.  However,  we  found 
that  the  components  did  not  adequately  carry  out  the  procedures  required 
by  the  FIAR  Guidance  for  the  two  FIPs  we  reviewed.  Top  managers 
involved  in  FIP  oversight  also  did  not  properly  monitor  and  assess  the 
status  of  FIP  efforts  in  order  to  make  accurate  decisions  regarding  audit 
readiness.  As  a  result,  both  the  Navy’s  and  Air  Force’s  conclusions  of 
audit  readiness  for  civilian  pay  and  military  equipment,  respectively,  were 
unsupported.  Both  the  Navy  and  the  Air  Force  indicated  that  they  have 
initiated  additional  actions  to  address  the  identified  deficiencies,  but  they 
did  not  provide  supporting  documentation  for  us  to  verify  their  actions.  To 
achieve  departmentwide  audit  readiness,  DOD  leaders  will  need  to 
ensure  that  the  components  develop,  implement,  and  document  their 
FIPs  in  compliance  with  the  FIAR  Guidance.  Considering  the  deficiencies 
identified  in  this  report  can  help  inform  DOD  leaders  and  the  components 
as  they  develop  and  implement  other  FIPs  to  better  utilize  resources  by 
minimizing  rework.  If  the  DOD  components  are  unable  to  achieve  interim 
FIAR  milestones,  DOD  will  need  to  consider  the  effect  on  its  ability  to 
achieve  departmentwide  audit  readiness  by  September  30,  2017. 


Recommendations  for  are  ma*<'n9  ^  recommendations  to  the  Secretary  of  Defense  to 

improve  the  development,  implementation,  documentation,  and  oversight 
Executive  Action  of  the  department’s  financial  management  improvement  efforts. 
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To  ensure  that  the  Navy  develops  and  implements  its  Financial 
Improvement  Plan  in  accordance  with  the  FIAR  Guidance,  we 
recommend  that  the  Secretary  of  Defense  direct  the  Secretary  of  the 
Navy  to  put  procedures  in  place  to  help  ensure  that  the  Navy’s  Financial 
Improvement  Plans  include  documentation  that  the  Navy  performed  the 
following: 

•  Sufficient  control  and  substantive  testing. 

•  A  reconciliation  of  the  complete  population  of  transactions  for  an 
assessable  unit  to  the  relevant  general  ledger(s)  and  to  the  amount(s) 
reported  in  the  financial  statements,  including  researching  and 
resolving  reconciling  items. 

•  An  assessment  of  information  systems  controls  that  (1 )  addresses  all 
relevant  critical  elements,  and  (2)  for  any  deficiencies  identified  in  a 
SAS  70  report  that  is  relied  upon,  show  that  either  mitigating  controls 
exist  or  actions  have  been  taken  to  address  the  deficiencies. 

•  Preparation  and  execution  of  corrective  action  plans  to  address 
significant  control  weaknesses. 

•  Assessments  of  the  metrics  (e.g.,  key  control  objectives  and  key 
supporting  documents)  to  ensure  that  they  are  consistent  with,  and 
supported  by,  testing  results. 

To  ensure  that  the  Air  Force  develops  and  implements  its  Financial 
Improvement  Plan  in  accordance  with  the  FIAR  Guidance,  we 
recommend  that  the  Secretary  of  Defense  direct  the  Secretary  of  the  Air 
Force  to  ensure  that  the  Air  Force’s  Financial  Improvement  Plans  include 
documentation  that  the  Air  Force  performed  the  following: 

•  Sufficient  control  and  substantive  testing. 

•  A  reconciliation  of  the  complete  population  of  transactions  for  an 
assessable  unit  to  the  relevant  general  ledger(s)  and  to  the  amount(s) 
reported  in  the  financial  statements,  including  researching  and 
resolving  reconciling  items. 

•  An  assessment  of  information  systems  controls  that  includes 
documentation  of  both  the  testing  and  the  results. 

•  Preparation  and  execution  of  corrective  action  plans  to  address 
significant  control  weaknesses. 

To  ensure  that  other  FIPs  from  DOD  components  comply  with  the 
requirements  in  the  FIAR  Guidance,  we  recommend  that  the  Secretary  of 
Defense  direct  the  Secretary  of  the  Army  and  the  heads  of  other  DOD 
components  to  consider  the  weaknesses  identified  in  this  report  when 
preparing  their  FIPs. 
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To  improve  DOD’s  monitoring  and  oversight  of  FIP  activities,  we 

recommend  that  the  Secretary  of  Defense  direct: 

•  The  Co-Chairs  of  the  FIAR  Governance  Board  to  ensure  that  the 
board  carries  out  its  responsibilities  for  identifying  risks  that  could 
prevent  the  department  from  achieving  its  goals  and  ensuring 
sufficient  documentation  of  FIP  assessment  results. 

•  The  Secretary  of  the  Navy  to  ensure  that  all  responsible  parties  within 
the  Navy,  including  the  Assistant  Secretary  of  the  Navy  (Financial 
Management  and  Comptroller),  carry  out  their  responsibilities  for 
ensuring  that  FIP  development  and  implementation  complies  with  the 
FIAR  Guidance  and  that  the  FIP  contains  sufficient  information  to 
indicate  audit  readiness  before  it  is  signed. 

•  The  Secretary  of  the  Air  Force  to  ensure  that  all  responsible  parties 
within  the  Air  Force,  including  the  Assistant  Secretary  of  the  Air  Force 
(Financial  Management  and  Comptroller)  carry  out  their 
responsibilities  for  ensuring  that  FIP  development  and  implementation 
complies  with  the  FIAR  Guidance  and  that  the  FIP  contains  sufficient 
information  to  indicate  audit  readiness  before  it  is  signed. 


Agency  Comments 
and  Our  Evaluation 


We  provided  a  draft  of  this  report  to  the  Secretary  of  Defense  and 
received  written  comments  from  the  Under  Secretary  of  Defense 
(Comptroller),  which  are  reprinted  as  appendix  III.  Overall,  DOD 
concurred  with  10  recommendations  and  partially  concurred  with  three, 
and  identified  some  specific  actions  that  are  completed,  underway,  or 
planned. 

DOD  commented  that  its  approach  of  prioritizing  its  efforts  on  improving 
information  related  to  budgetary  resources  and  the  existence  and 
completeness  of  its  assets  and  achieving  auditability  in  those  areas  has 
garnered  more  participation  and  attention  in  the  FIAR  effort  than  in  the 
past,  and  DOD  described  some  initiatives  underway  to  speed  progress  on 
this  effort.  DOD  recognized  that  there  is  room  for  improvement  in 
implementation  of  the  FIP  process  by  the  military  components  as  well  as 
in  governance  and  management  of  the  process.  In  that  regard,  DOD 
concurred  with  10  of  our  recommendations,  and  said  that  it  is  critical  to 
continue  to  review  how  DOD  applies  lessons  learned  across  the 
department  and  changes  business  processes  to  reflect  those  lessons.  We 
agree  that  identifying  and  incorporating  lessons  learned  into  the  FIAR 
process  will  be  an  important  part  of  effective  implementation,  and  we  look 
forward  to  seeing  how  DOD  develops  a  mechanism  to  capture  and 
disseminate  the  lessons. 
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DOD  partially  concurred  with  three  other  recommendations  specifically 
related  to  the  Navy  and  Air  Force  FIPs.  DOD  explained  that  the  Navy  and 
Air  Force  FIPs  that  we  reviewed  were  prepared  before  issuance  of  the 
May  2010  FIAR  Guidance  and  may  have  proceeded  with  a  strategy  that 
was  not  sufficiently  supported,  but  that  corrective  actions  are  underway. 
As  we  discussed  with  DOD,  although  the  FIPs  we  selected  were  initiated 
prior  to  issuance  of  the  final  FIAR  Guidance,  the  issues  we  identified  are 
consistent  with  draft  FIAR  Guidance  as  well  as  standard  procedures  for 
conducting  a  financial  statement  audit  that  we  found  to  be  incorporated 
into  the  final  FIAR  Guidance.  On  our  recommendation  related  to 
improving  the  Navy’s  process  for  reconciling  transactions  with  its  general 
ledgers,  DOD  partially  concurred,  but  noted  that  the  Navy  will  be  unable 
to  reconcile  transaction  populations  until  it  completes  its  Financial 
Statement  Compilation  Process.  As  we  report,  performing  reconciliations 
is  key  to  properly  testing  financial  statement  amounts  and  therefore 
should  be  done  prior  to  asserting  audit  readiness. 

On  our  recommendation  related  to  improving  the  sufficiency  of  the  Air 
Force’s  control  and  substantive  testing,  DOD  partially  concurred,  but 
noted  that  the  Air  Force  based  the  extent  of  its  testing  procedures  on  its 
assessment  of  the  inherent  risk  of  the  asset  category,  stating  that  ICBMs 
were  not  tested  due  to  their  limited  number  and  extensive  controls  for 
these  assets.  Although  the  Air  Force’s  FIP  noted  that  ICBMs  are  subject 
to  extensive  controls,  the  FIP  did  not  document  those  controls  or  any 
tests  conducted  to  validate  the  controls.  Also,  for  RPAs,  satellites,  and 
pods,  no  evidence  of  controls  was  provided  and  no  testing  was  done. 
While  the  FIAR  Guidance  allows  components  to  use  a  substantive 
approach  (versus  a  controls  approach)  when  there  are  a  limited  number 
of  items,  it  does  not  allow  no  testing  if  an  area  is  significant  or  material. 
Also  as  we  report,  the  Air  Force’s  basis  for  its  judgmental  selection  of  the 
locations  to  test  aircraft  was  inadequate  since  it  did  not  demonstrate  that 
the  processes  and  controls  at  the  five  selected  sites  were  representative 
of  all  other  locations  not  tested.  In  addition  to  partial  concurrence  with  this 
recommendation,  DOD  commented  it  will  further  review  this  issue  and 
take  action  as  appropriate. 

On  our  recommendation  related  to  improving  the  Air  Force’s  corrective 
action  plans,  DOD  partially  concurred,  but  noted  that  when  the  Air  Force 
asserted  auditability  it  did  not  believe  that  the  issues  being  addressed  by 
corrective  actions  were  significant  control  weaknesses  and,  therefore,  the 
Air  Force  was  allowed  under  the  FIAR  Guidance  to  assert  auditability.  We 
believe  that  the  Air  Force  reported  significant  control  weaknesses  that 
would  have  precluded  an  assertion  of  auditability;  the  FIAR  Guidance 
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does  not  allow  for  auditability  assertions  when  there  are  unresolved 
material  deficiencies.  For  example,  as  we  report,  the  Air  Force 
documented  that  it  was  unable  to  reconcile  its  population  of  transactions 
to  its  financial  statements,  and  as  a  result,  did  not  have  assurance  that 
the  testing  done  covered  the  population  of  military  equipment.  Also,  the 
Air  Force  reported  errors  in  its  depreciation  amounts  and  that  accurate 
depreciation  amounts  were  “essential”  and  Air  Force  military  equipment 
“will  not  be  ready  for  audit”  if  not  corrected.  The  Air  Force  also  reported 
that  the  cause  of  errors  was  “unknown.”  Although  the  Air  Force 
subsequently  withdrew  part  of  its  FIP  related  to  some  of  these  issues,  we 
evaluated  the  content  of  the  FIP  that  the  Air  Force  asserted  was  audit- 
ready.  In  addition  to  partial  concurrence  with  this  recommendation,  DOD 
commented  it  will  further  review  this  issue  and  take  action  as  appropriate. 


As  agreed  with  your  offices,  we  plan  no  further  distribution  of  this  report 
until  two  days  from  its  date,  unless  you  publicly  announce  its  contents 
earlier.  At  that  time,  we  will  send  copies  of  this  report  to  the  Secretary  of 
Defense;  the  Under  Secretary  of  Defense  (Comptroller);  the  Secretary  of 
the  Navy;  the  Secretary  of  the  Air  Force;  the  Deputy  Chief  Management 
Officer;  the  Chief  Management  Officer  of  the  Navy;  and  the  Chief 
Management  Officer  of  the  Air  Force.  This  report  also  is  available  at  no 
charge  on  the  GAO  Web  site  at  http://www.gao.gov. 

If  you  or  your  staff  have  any  questions  concerning  this  report,  please 
contact  Asif  A.  Khan  at  (202)  512-9095  or  khana@gao.gov.  Contact 
points  for  our  Offices  of  Congressional  Relations  and  Public  Affairs  may 
be  found  on  the  last  page  of  this  report.  Key  contributors  to  this  report  are 
listed  in  appendix  IV. 


Director 

Financial  Management  and  Assurance 
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Appendix  I:  Objectives,  Scope,  and 
Methodology 


Our  objectives  were  to  determine  whether  (1)  the  Financial  Improvement 
and  Audit  Readiness  (FIAR)  Guidance  provided  a  reasonable 
methodology  for  the  Department  of  Defense  (DOD)  components  to 
develop  Financial  Improvement  Plans  (FIP),  (2)  the  DOD  components 
had  adequately  developed  and  implemented  selected  FIPs  in  accordance 
with  the  FIAR  Guidance,  and  (3)  DOD  is  adequately  monitoring  and 
overseeing  the  FIP  process. 

To  address  the  first  objective,  we  analyzed  the  FIAR  Guidance  using 
relevant  criteria  such  as  the  GAO  and  President’s  Council  on  Integrity  and 
Efficiency  (PCIE)  Financial  Audit  Manual  (FAM);  the  Federal  Information 
System  Controls  Audit  Manual  (FISCAM);  and  Office  of  Management  and 
Budget  (OMB)  Circular  No.  A-123,  Management’s  Responsibility  for 
Internal  Control,  Appendix  A,  Internal  Control  over  Financial  Reporting. 
The  FAM  provides  a  methodology  to  perform  financial  statement  audits  of 
federal  entities  in  accordance  with  professional  auditing  and  attestation 
standards  and  OMB  guidance.  The  FISCAM  provides  a  methodology  for 
performing  information  system  control  audits  in  accordance  with  generally 
accepted  government  auditing  standards.  The  OMB  Circular  No.  A-123 
provides  guidance  to  Federal  managers  on  improving  the  accountability 
and  effectiveness  of  Federal  programs  and  operations  by  establishing, 
assessing,  correcting,  and  reporting  on  internal  control.  Appendix  A  of 
OMB  Circular  No.  A-123  provides  a  methodology  to  assess  and  report  on 
agencies’  internal  controls  over  financial  reporting.  We  also  interviewed 
agency  officials  at  the  Office  of  the  Under  Secretary  of  Defense 
(Comptroller)  (OUSD(C))  FIAR  Directorate’s  office,  which  developed  the 
FIAR  Guidance,  and  at  the  Navy  and  Air  Force  to  obtain  explanations  and 
clarifications  as  a  result  of  our  analysis  of  selected  FIPs. 

To  address  the  second  objective,  we  selected  FIPs  for  two  assessable 
units  (Navy  Civilian  Pay  and  Air  Force  Military  Equipment)  that  were 
scheduled  to  assert  audit  readiness  in  2010  and  were  within  wave  2  (i.e., 
Statement  of  Budgetary  Resources)  and  wave  3  (i.e.,  Existence  and 
Completeness  of  Mission  Critical  Assets)  since  these  waves  reflect 
DOD’s  priority  focus  areas.  Using  the  FIAR  Guidance,  we  analyzed  the 
documentation  included  in  the  FIPs,  such  as  process  flows,  control 
assessments,  test  plans,  test  results,  and  corrective  action  plans.  We  did 
not  perform  separate  audit  procedures  to  assess  the  effectiveness  of  the 
controls  or  the  completeness  or  accuracy  of  the  Navy  civilian  pay 
amounts  or  the  Air  Force  military  equipment.  We  interviewed  the  Navy 
and  Air  Force  FIP  directors  to  obtain  explanations  and  clarifications  as  a 
result  of  our  evaluation  of  the  documentation. 
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Appendix  I:  Objectives,  Scope,  and 
Methodology 


To  address  the  third  objective,  we  analyzed  relevant  documentation,  such 
as  the  FIAR  Guidance,  FIAR  Plan  Status  Reports,  and  committee 
charters  and  meeting  minutes,  to  identify  the  entities  and  officials 
responsible  for  monitoring  and  oversight  as  well  as  their  roles  and 
responsibilities.  We  also  interviewed  officials  that  play  a  key  role  in  the 
monitoring  and  oversight  process,  such  as  Army,  Navy,  and  Air  Force 
officials  from  the  offices  of  Financial  Management  and  Comptroller  and 
the  Deputy  Chief  Management  Officers  and  DOD  officials  from  the  Office 
of  the  Under  Secretary  of  Defense  (Comptroller),  to  clarify  our 
understanding  of  these  entities  and  officials’  roles  and  responsibilities.  We 
then  analyzed  this  information  using  elements  of  monitoring  discussed  in 
the  FAM;  the  Implementation  Guide  for  OMB  Circular  No.  A-123, 

Appendix  A;1  Standards  for  Internal  Control  in  the  Federal  Government ;2 
the  Internal  Control  Management  and  Evaluation  Tool]3  the  COSO 
Guidance  on  Monitoring  Internal  Control  Systems ;  and  the  FIAR 
Guidance. 

We  conducted  this  performance  audit  from  May  2010  to  September  2011 
in  accordance  with  generally  accepted  government  auditing  standards. 
Those  standards  require  that  we  plan  and  perform  the  audit  to  obtain 
sufficient,  appropriate  evidence  to  provide  a  reasonable  basis  for  our 
findings  and  conclusions  based  on  our  audit  objectives.  We  believe  the 
evidence  obtained  provides  a  reasonable  basis  for  our  findings  and 
conclusions  based  on  our  audit  objectives. 


1  OMB  Circular  No.  A-123,  Appendix  A,  Implementation  Guide  for  Internal  Control  Over 
Financial  Reporting  (Dec.  21, 2004). 

2  Standards  for  Internal  Control  in  the  Federal  Government,  GAO/AIMD-OO-21.3.1 
(Washington  D.C.:  November  1999). 

3  Internal  Control  Management  and  Evaluation  Tool,  GAO-01-1008G  (Washington  D.C.: 
August  2001). 
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Appendix 

II:  Key  Oversight  Entities  and  Their 

Roles  and 

Responsibilities 

The  following  table  summarizes  the  roles  and  responsibilities  of  key 
individuals  and  committees  involved  in  monitoring  and  overseeing  the  FIP 

process. 

Table  4:  Key  Oversight  Entities  and  Their  Roles  and  Responsibilities. 

Group  or  official 

Description  of  roles  and  responsibilities 

Department  of  Defense 

Office  of  the  Under  Secretary  of  Defense 
(Comptroller)  (OUSD(C)) 

-  Reviews  FIP  status  and  the  progress  in  meeting  both  overall  FIAR  objectives  and 
interim  milestones. 

-  Develops  and  issues  detailed  financial  improvement  and  audit  preparation 
methodologies  and  guidance  to  standardize  component  FIPs,  and  provides 
training  on  the  FIAR  Guidance  and  proper  execution  of  FIP  activities. 

-  Develops  metrics  for  monitoring  and  reporting  FIP  progress. 

-  Reviews  the  component  FIPs  as  they  are  being  developed  and  implemented, 
provides  assistance  to  components  in  developing  and  implementing  FIPs  (e.g., 
helping  prepare  test  plans),  and  provides  feedback  on  the  plans. 

-  Reviews  component  FIPs  to  ensure  management  testing  results  reasonably 
indicate  audit  readiness. 

-  Reviews  the  examination  results  of  the  independent  public  accountant  (IPA)  or 
other  qualified,  independent  reviewer;  makes  a  final  determination  of  the 
assessable  unit’s  audit  readiness;  and  communicates  to  the  reporting  entity 
whether  to  proceed  with  the  Sustainment/Audit  Phase  or  return  to  the  Corrective 
Action  Phase. 

FIAR  Governance  Board3 

-  Co-Chaired  by  the  Under  Secretary  of  Defense  (Comptroller)  [USD(C)]  and  the 
DOD  Deputy  Chief  Management  Officer  (DCMO). 

-  Members  include  Military  Department  DCMOs,  Military  Department  Assistant 
Secretaries-  Financial  Management  and  Comptroller  (FM&C),  DOD  functional 
community  senior  leaders  (e.g.,  Assistant  Secretary-Logistics  and  Material 
Readiness),  and  DOD  Office  of  Inspector  General  (Advisory  Member). 

-  Meets  quarterly  to  provide  leadership  and  oversight  of  the  Department’s  FIAR 
plans  (including  reviewing  the  progress  on  each  Component’s  FIP)  and  identify 
risks  that  could  prevent  the  department  from  achieving  its  goals. 

-  Ensures  sufficient  documentation  of  the  FIP  assessment  results. 

Inspector  General 

-  Reviews  the  FIP  to  assess  whether  it  demonstrates  audit  readiness  and  notifies 
the  OUSD(C)  and  component  of  its  assessment. 

-  Performs  examination  of  the  component’s  management  audit  readiness  assertion 
and  issues  an  examination  report  opining  on  management’s  assertion  of  audit 
readiness. 

-  Performs  (or  engages  an  IPA  to  perform)  audits  of  the  assessable  units  and  the 
component’s  financial  statements. 

Military  Components  (Air  Force,  Army,  Navy)b 

Component  Senior  Executive  Committees3 

-  Chaired  by  the  Assistant  Secretary  (FM&C)  or  Deputy  Assistant  Secretary  for 
Financial  Operations  (FM&C). 

-  Members  include  the  Deputy  Assistant  Secretary  for  Financial  Operations 
(FM&C),  Chief  Information  Officer,  and  senior  leaders  from  the  functional 
communities  (e.g.,  Assistant  Secretary-Research,  Development,  and  Acquisition). 

-  Meets  quarterly  to  review  progress  of  the  FIPs  in  addressing  financial 
management  weaknesses,  including  the  identification  and  remediation  of  internal 
control  deficiencies. 
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Appendix  II:  Key  Oversight  Entities  and  Their 
Roles  and  Responsibilities 


Group  or  official 

Description  of  roles  and  responsibilities 

Assistant  Secretary-  Financial  Management  and 
Comptroller  (FM&C) 

-  Has  overall  responsibility  for  the  financial  improvement  and  audit  readiness 
efforts  within  their  respective  component. 

-  Reviews  FIP  status  and  the  progress  in  meeting  interim  and  long-term 
milestones. 

-  Reviews  FIP  and  determines  whether  the  assessable  unit  is  audit-ready. 

Financial  Improvement  Plan/Audit  Readiness 
Director 

-  Manages  the  development  and  implementation  of  FIPs  including  the  identification 
and  assessment  of  controls;  development  and  execution  of  test  plans;  and 
assessment  of  test  results. 

-  Meets  regularly  with  senior  financial  management  and  oversight  committees  to 
provide  updates  on  the  FIP. 

-  Determines  when  the  results  of  the  FIP  work  are  sufficient  to  support  an 
assertion  of  audit  readiness  for  an  assessable  unit. 

Source:  GAO  analysis  of  DOD  documents  and  interviews  with  agency  officials. 

aFIAR  Governance  Board  is  supported  by  the  FIAR  Committee,  which  in  turn  is  supported  by  the 
FIAR  Subcommittee. 

bThe  titles  of  the  groups  and  officials  listed  are  general  descriptive  titles  and  do  not  necessarily  reflect 
actual  titles.  The  roles  and  responsibilities  listed  are  general  characterizations  and  not  a 
comprehensive  listing. 

cFor  the  Navy,  this  includes  the  Navy  Audit  Committee.  For  the  Air  Force,  this  includes  its  Financial 
Improvement  Executive  Steering  Committee,  Senior  Assessment  Team  and  the  Accountability  and 
Financial  Management  Integrated  Process  Team.  For  the  Army,  this  includes  the  Army  Audit 
Committee  and  the  Senior  Level  Steering  Group,  Senior  Assessment  Team. 
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Appendix  III:  Comments  from  the 
Department  of  Defense 


UNDER  SECRETARY  OF  DEFENSE 

1  IOO  DEFENSE  PENTAGON 
WASHINGTON.  DC  20301-1  I  DO 


Mr.  Asif  A.  Khan  AUG  2  3  20)1 

Director.  Financial  Management  and  Assurance 

li.S.  Government  Accountability  Office 

441  G  Street,  NW 

Washington,  DC  2(1548 

Dear  Mr.  Khan. 

flits  is  the  Department  of  Defense  (DoD)  response  to  the  Government  Accountability 
Office  (GAO)  draft  report  GAO-1 1-851.  "DoD  Financial  Management:  Improvement  Needed  in 
DOD  Components’  Implementation  of  Audit  Readiness  Effort."  dated  August  12,  201 1  (GAO 
Code  198002).  Detailed  comments  are  enclosed  with  this  letter. 

The  Department  has  developed  and  implemented  a  streamlined  approach  to  achieve 
auditable  financial  statements.  Tins  approach  focuses  on  the  information  that  is  most  used  to 
manage  sn  the  Department  budgetary  information,  and  the  financial  information  that  most 
impacts  our  mission  readiness  the  existence  and  completeness  of  assets.  Because  of  this 
strategic  prioritization,  we  have  more  participation  in  and  attention  to  this  effort  than  in  the  past. 

1  appreciate  the  support  for  this  approach  and  the  related  methodology  for  achieving  audit 
readiness  that  you  retted  in  your  report. 

1  am  not  surprised  your  report  also  indicates  your  review  found  instances  where  the 
Department  needs  to  improve  implementation  of  this  strategy  and  methodology.  While  we  (Jo 
not:  agree  with  all  of  your  detailed  findings,  as  we  have  discussed  with  your  audit  team,  we  do 
agree  there  is  room  for  improvement  in  the  planning  and  execution  of  our  audit  readiness  efforts. 
The  origins  of  both  assertion  packages  that  your  team  reviewed  predate  the  current  guidance  and 
may  have  proceeded  with  a  strategy  that  was  not  sufficiently  supported.  Corrective  actions  (sir 
these  assertions  are  underway  and  more  recent  efforts  continue  to  demonstrate  improvement  in 
both  understanding  and  application  of  the  audit  readiness  guidance.  Thai  said,  it  is  critical  that 
ive  continue  to  look  at  how  effectively  we  are  applying  lessons  learned  across  the  enterprise  and 
arc  changing  business  processes  to  reflect  those  lessons. 

Your  recommendations  also  focus  on  our  governance  and  management.  We  agree  that 
achiev  ing  audit  readiness  not  only  involves  improvements  to  systems,  processes,  and  controls  but 
also  is  dependent  on  our  ability  to  effectively  govern  and  manage  this  enormous  change 
management  effort.  My  counterparts  in  senior  leadership  and  1  are  working  to  instill  new 
priorities,  skills,  and  qualifications  in  personnel  throughout  the  Department  to  better  manage  the 
audit  readiness  effort. 
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As  your  report  indicates.  we  have  several  initiatives  already  underway  to  speed  our 
progress  including: 

•  The  Service  Under  Secretaries  (Component  Chief  Management  Officers)  have 
committed  to  achieve  specific  measurable  interim  milestones  to  full  audit  readiness  in 
Fiscal  Years  201  I  and  2012 

•  Audit  readiness  goals  will  be  included  in  the  Fiscal  Year  20 1 2  performance  plans  of 
all  relevant  Senior  Executive  Service  members. 

•  Each  Service  has  designated  a  team  of  experienced  auditors  to  assess,  test,  and  help 
improve  financial  processes  and  controls  in  Service  operational  organizations. 

Thank  you  for  the  opportunity  to  comment,  Wc  look  forward  to  your  continued 
involvement  in  our  effort  and  assistance  by  recommending  improvements.  My  point  of  contact 
for  this  effort  is  Mr  Joseph  Quinn  lie  can  be  reached  at  571  -256-2678  or 
joseph.quinnfrt;osd.mil, 

Sincerely, 


Robert  F.  Hale 


Enclosure: 
A  s  stated 
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GAO  DRAFT  REPORT  DATED  AUGUST  12,  201 1 
G  AO- 1 1-851  (GAO  CODE  imtlfj 

“DOD  FINANCIAL  MANAGEMENT:  IMPROV  EMENT  NEEDED  IN  DO!) 
COMPONENTS’  IMPLEMENTATION  OF  AUDIT 
READINESS  EFFORT" 

DEPARTMENT  OF  DEFENSE  C  OMMENTS 
TO  THE  GAO  RECOMMENDATIONS 


RECOMMENDATION  I :  The  GAO  recommends  that  to  ensure  that  the  Navy 
develops  and  implements  its  Financial  Improvement  Plan  (HP)  in  accordance  with  the 

Financial  Improvement  and  Audit  Readiness  (FIAR)  Guidance,  the  Secretary  of  Defense 

direct  the  Secretary  of  the  Navy  to  put  procedures  in  place  to  help  ensure  that  the  Navy’s 
HPs  include  documentation  that  tire  Navy  performed  sufficient  control  and  substantive 
testing. 

DoD  RESPONSE:  Concur.  Department  of  Navy  (DON)  comments  acknowledged  the 
importance  of  compliance  with  the  FIAR  Guidance  but  also  noted  that  the  FIAR 
Guidance  was  published  alter  the  DON  Civilian  Pay  management  assertion  and  had 
follow  ed  a  testing  strategy  that  had  been  judged  to  be  sufficient.  On  behalf  of  the 
Secretary  of  Defense,  the  Under  Secretary  of  Defense  (Comptroller) Chief  Financial 
Officer  (USD(C)  CFO)  is  reviewing  DoD/Component  Financial  Improvement  and  Audit 
Readiness  (FIAR)  plans  with  appropriate  DoD  leaders  to  determine  what  improvements 
can  be  made  to  address  these  kind  of  deficiencies  and  as  a  result,  speed  progress.  Upon 
completion  of  this  review,  the  Secretary  will  issue  formal  direction  to  the  Service 
Secretaries  and  other  leaders  on  additional  actions  they  must  take  to  ensure  sufficient  and 
qualified  resources  are  devoted  to  achieving  this  priority  in  alignment  with  the 
Department's  strategy  and  methodology  including  the  aspects  of  that  methodology  noted 
in  this  finding. 

RECOMMEN  DATION  2:  The  GAO  recommends  that  to  ensure  that  the  Navy 
develops  and  implements  its  FIP  in  accordance  with  the  Financial  Improvement  and 
Audit  Readiness  (FIAR)  Guidance,  the  Secretary  of  Defense  direct  the  Secretary  of  the 
Navy  to  put  procedures  in  place  to  help  ensure  that  the  Navy’s  l-'IPs  include 
documentation  that  the  Nav  y  performed  a  reconciliation  of  the  complete  population  of 
transactions  tor  an  assessable  unit  to  the  relevant  general  ledger! s)  and  to  Che  amoum(s) 
reported  in  the  financial  statements,  including  researching  and  resolving  reconciling 
items. 

DoD  RESPONSE:  Partially  concur  DON  comments  noted  that  its  management 
assertion  was  limited  to  the  civilian  pay  transaction  population  recorded  in  the  general 

ledgers;  DON  will  be  unable  to  reconcile  assessable  unit  transaction  populations  to  the 

Statement  of  Budgetary  Resources  until  it  completes  continuing  work  on  its  Financial 
Statement  Compilation  business  process.  On  behalf  of  the  Secretary  of  Defense,  the 
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Under  Secretary  of  Defense  (ComptroIlcrRChief  Financial  Officer  (USD(C)/CFO)  is 
reviewing  DoD  Component  Financial  Improvement  and  Audit  Readiness  (FIAR)  plans 
with  appropriate  DoD  leaders  to  determine  what  improvements  can  he  made  to  address 
these  kind  of  deficiencies  and  as  a  result,  speed  progress.  Upon  completion  of  this 
review,  the  Secretary  will  issue  formal  direction  to  the  Service  Secretaries  and  other 
leaders  on  additional  actions  they  must  take  to  ensure  sufficient  and  qualified  resources 
are  devoted  to  achieving  this  priority  in  alignment  with  the  Department’s  strategy  anti 
methodology  including  the  aspects  of  that  methodology  noted  in  this  finding. 

RECOMMENDATION  3:  The  GAO  recommends  that  to  ensure  that  the  Navy 
develops  and  implements  its  FiP  in  accordance  with  the  FIAR  Guidance,  the  Secretary  of 
Defense  direct  the  Secretary  of  the  Navy  to  put  procedures  in  place  to  help  ensure  that  the 
Navy’s  FIPs  include  documentation  that  the  Navy  performed  an  assessment  of 
information  systems  controls  that  (1)  addresses  ail  relevant  critical  dements,  and  (2)  for 
any  deficiencies  identified  in  a  SAS  70  report  that  is  relied  upon,  show  that  either 
mitigating  controls  exist  or  actions  hav  e  been  taken  to  address  the  deficiencies 

DoD  RESPONSE:  Concur.  DON  comments  acknowledged  the  importance  of 
assessment  of  inionnation  system  controls.  DON  will  assess  the  system  general  and 
application  controls  for  DON-owned  systems  and  work  with  its  service  providers  and 
OUSD(C)  for  controls  assessments  (and  subsequent  corrective  action)  on  systems 
managed  and  maintained  outside  of  DON.  On  behalf  of  the  Secretary  of  Defense,  the 
Under  Secretary  of  Defense  (Camplroiier)/Chief  Financial  Officer  (USD(C)/CFO)  is 
reviewing  DoD.Comporient  Financial  Improvement  and  Audit  Readiness  (FIAR)  plans 
with  appropriate  DoD  leaders  to  determine  w  hat  improvements  can  be  made  to  address 
these  kind  of  deficiencies  and  as  a  result,  speed  progress.  Upon  completion  of  this 
review,  ihe  Secretary  will  issue  formal  direction  to  the  Service  Secretaries  and  other 
leaders  on  additional  actions  they  must  take  to  ensure  sufficient  anti  quatilied  resources 
are  devoted  to  achieving  this  priority  in  alignment  with  the  Department's  strategy  and 
methodology  including  the  aspects  of  that  methodology  noted  in  this  finding. 

RECOMMENDATION  4:  The  GAO  recommends  that  to  ensure  that  the  Navy 
develops  and  implements  its  I  IP  in  accordance  with  the  FIAR  Guidance,  the  Secretary  of 

Defease  direct  the  Secretary  of  the  Navy  to  put  procedures  in  place  to  help  ensure  that  the 

Navy’s  FIPs  include  documentation  that  tiie  Navy  performed  preparation  and  execution 
of  corrective  action  plans  to  address  significant  control  weaknesses, 

DoD  RESPONSE:  Concur.  DON  comments  noted  that  its  corrective  action  plans  are 
pan  of  its  detailed  plan  of  action  and  milestones  for  its  Statement  of  Budgetary 
Resources.  Additionally.  DON  is  dependent  on  external  serv  ice  providers  to  complete  a 
number  of  corrective  actions  and  will  work  with  its  service  providers  and  OUSD(C)  to 
facilitate  resolution  of  these  actions.  On  behalf  of  the  Secretary  of  Defense,  the  Under 
Secretary  of  Defense  (ComptrollcrVChief  Financial  Officer  (USD(CV'CFO)  is  reviewing 
DoD  Component  Financial  improvement  and  Audit  Readiness  (FIAR)  plans  with 
appropriate  DoD  leaders  to  determine  what  improvements  can  lie  made  to  address  these 
kind  of  deficiencies  and  as  a  result,  speed  progress.  Upon  completion  of  this  review,  the 
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Secretary  will  issue  formal  direction  to  the  Service  Secretaries  and  other  leaders  on 
additional  actions  they  must  take  to  ensure  sufficient  and  qualified  resources  are  devoted 
to  achieving  this  priority  in  alignment  with  the  Department's  strategy  ami  methodology 
including  the  aspects  of  (hut  methodology  noted  in  tins  finding, 

RECOMMENDATION  5:  The  GAO  recommends  that  to  ensure  that  the  Na\  y 
develops  and  implements  us  HP  in  accordance  with  the  FEAR  Guidance,  the  Secretary  of 
Defense  direct  the  Secretary  of  the  Navy  to  put  procedures  in  place  to  help  ensure  that  the 
Navy's  FlPs  include  documentation  that  the  Navy  performed  assessments  of  the  metrics 
(e.g..  key  control  objectives  and  key  supporting  documents)  to  ensure  that  they  are 
consistent  with,  and  supported  by,  testing  results, 

DoD  RESPONSE;  Concur.  On  behalf  of  the  Secretary  of  Defense,  the  Under  Secretary 
of  Defense  (Comptroller), Chief  Financial  Officer  (UsblC)  CFO)  is  reviewing 
DoD  Component  Financial  Improvement  and  Audit  Readiness  (1-TAR)  plans  with 
appropriate  DoD  leaders  to  determine  what  improvements  can  be  made  to  address  these 
kind  of  deficiencies  and  as  a  result,  speed  progress.  Upon  completion  of  this  review,  the 
Secretary  will  issue  formal  direction  to  the  Serv  ice  Secretaries  and  other  leaders  on 
additional  actions  they  must  take  to  ensure  sufficient  and  qualified  resources  are  devoted 
to  achieving  this  priority  in  alignment  with  the  Department’s  strategy  and  methodology 
including  the  aspects  of  that  methodology  noted  in  this  finding. 

RECOMMENDAT  ION  6;  The  GAO  recommends  that  to  ensure  that  the  Air  Force 
develops  and  implements  it’s  FTP  in  accordance  with  the  FIAR  Guidance,  the  Secretary 
of  Defense  direct  the  Secretary  of  the  Air  Force  lo  ensure  that  the  Air  Force’s  FTPs 
include  documentation  that  the  Air  Force  performed  sufficient  control  and  substantive 
testing, 

DoD  RESPONSE:  Partially  concur.  The  Air  Force  adheres  to  the  OSD  FIAR  Guidance 
and  any  referenced  instructions  including  the  GAO  Financial  Audit  Manual  (FAM).  The 
Air  Force  based  the  extent  of  its  testing  procedures  on  the  inherent  risk  of  the  asset 
category.  For  example,  the  Air  Force  did  not  attempt  to  test  the  existence  and 
completeness  for  ICBMs  due  to  the  limited  number  of  assets  and  the  extensive  controls 
for  these  assets.  The  Air  Force’s  initial  assessment  is  supported  by  recently  completed 
work  by  the  AFAA  which  tested  60  ICBMs  and  did  not  find  any  exceptions  for  Existence 
and  Completeness,  To  support  its  assertion  the  Air  Force  tested  1 98  aircraft  and  did  not 
find  any  exceptions. 

On  behalf  of  the  Secretary  of  Defense,  the  Under  Secretary  of  Defense  (Comptroller).'' 
Chief  Financial  Officer  (USD(C)i'CFO)  is  reviewing  DoD  Coinponent  Financial 
Improvement  and  Audit  Readiness  (FIAR)  plans  with  appropriate  DoD  leaders  to 
determine  w  hat  improvements  can  be  made  to  address  these  i'll  si  of  deficiencies  and  as  a 
result,  speed  progress  Upon  completion  of  this  review,  the  Secretary  will  issue  formal 
direction  to  the  Service  Secretaries  and  other  leaders  on  additional  actions  they  must  take 
to  ensure  sufficient  and  qualified  resources  are  devoted  to  achieving  this  priority  in 
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alignment  with  the  Department's  strategy  and  methodology  including  the  aspects  of  that 
methodology  noted  in  this  linding, 

RECOMMENDATION  7:  The  GAO  recommends  that  to  ensure  that  the  Air  Force 
develops  and  implements  its  PIP  in  accordance  with  the  FIAR  Guidance,  the  Secretary  of 
Defense  direct  the  Secretary  of  the  Air  Force  to  ensure  that  the  Air  Force's  FIPs  include 
documentation  that  the  Air  Force  performed  a  reconciliation  of  the  complete  population 
of  transactions  for  an  assessable  unit  to  the  relevant  general  ledger(s)  and  to  the 
amount(s)  reported  in  the  financial  statements,  including  researching  and  resolving 
reconciling  items. 

DoD  RESPONSE:  Concur.  Air  Force  comments  noted  that  tl  modified  the  assertion  for 
Military  Equipment,  limiting  it  to  the  OUSDtC)  priorities  of  Existence  and 
Completeness.  Individual  asset  records  reside  in  the  Accountable  Property  System  of 
Record  (APSR)  and  not  in  the  General  Ledger.  Therefore  it  was  not  necessary  or 
possible  to  reconcile  by  asset  the  records  in  the  APSR  to  the  General  l  edger  Other  Air 
Force  assertions  including  the  Budget  Authority  (BA)  and  Fund  Balance  with  Treasury 
Reconciliation  (FBwT)  include  reconciliations.  On  behalf  of  the  Secretary  of  Defense, 
the  Under  Secretary  of  Defense  (ComptrolferkChief  Financial  Officer  (  USD(C)  CFO)  is 
reviewing  DoD/Componcnt  Financial  Improvement  and  Audit  Readiness  (FIAR)  plans 
with  appropriate  DoD  leaders  to  determine  what  improvements  can  be  made  to  address 
these  kind  of  deficiencies  and  as  a  result,  speed  progress.  Upon  completion  of  this 
rev  iew,  the  Secretary  will  issue  formal  direction  to  the  Service  Secretaries  and  other 
leaders  on  additional  actions  they  must  take  to  ensure  sufficient  and  qualified  resources 
are  devoted  to  achieving  this  priority  in  alignment  with  the  Department’s  strategy  and 
methodology  including  the  aspects  of  that  methodology  noted  ill  this  finding. 

RECOMMENDATION  8:  The  GAO  recommends  that  to  ensure  that  the  Air  Force 
develops  and  implements  its  FIP  in  accordance  with  the  FIAR  Guidance,  the  Secretary  of 
Defense  direct  the  Secretary  of  the  Air  Force  to  ensure  that  the  Air  Force’s  FIPs  include 
documentation  that  the  Air  Force  performed  an  assessment  of  information  systems 
controls  that  includes  documentation  of  both  the  testing  and  the  results 

DoD  RESPONSE:  Concur.  Air  Force  comments  acknowledged  the  importance  of 
compliance  with  the  FIAR  Guidance,  including  assessment  of  information  systems 
controls  hut  also  noted  that  the  FIAR  Directorate  provided  guidance  on  general  and 
application  systems  control  approximately  45  days  after  the  military  equipment  assertion. 

The  Air  Force  took  action  to  have  Federal  Information  Systems  Controls  Audit  Manual 

(FISC AM)  documentation  developed  subsequent  to  assertion,  lire  Air  Force  has 
enhanced  tile  functionality  of  tire  Enterprise  Information  Technology  Data  Repository 
(BITDR)  to  include  additional  documentation  requirements  to  meet  F1SCAM 
requirement.  In  addition,  the  Air  Force  has  worked  with  Air  Force  Audit  Agency  to 
identify  and  prioritize  financial  and  financial  feeder  systems  for  FISCAM  audits. 

On  behalf  of  the  Secretary  of  Defense,  the  Under  Secretary  of  Defense 
(Comptroller J/Chief  Financial  Officer  (USD(Cf'tT'O)  is  reviewing  DoD'  Component 
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Financial  Improvement  and  Audit  Readiness  (FIAR)  plans  with  appropriate  DoD  leaders 
to  determine  what  improvements  can  be  made  to  address  these  kind  of  deficiencies  and  as 
a  result,  speed  progress.  Upon  completion  of  this  review,  the  Secretary  will  issue  formal 
direction  to  the  Service  Secretaries  and  other  leaders  on  additional  actions  they  must  take 
to  ensure  sufficient  and  qualified  resources  are  devoted  to  achieving  this  priority  in 
alignment  with  the  Department's  strategy  and  methodology  including  the  aspects  of  that 
methodology  noted  in  this  finding. 

RECOMMENDATION  9:  Tlic  GAO  recommends  that  to  ensure  that  the  Air  Force 
develops  and  implements  us  HIP  in  accordance  with  the  FIAR  Guidance,  the  Secretary  of 
Defense  direct  the  Secretary  of  the  Air  Force  to  ensure  that  the  Air  Force’s  FIPs  include 
documentation  that  the  Air  Force  performed  preparation  and  execution  of  corrective 
action  plans  to  address  significant  control  weaknesses 

DoD  RESPONSE:  Partially  concur.  The  Air  Force  comments  indicate  it  evaluates 
outstanding  corrective  actions  for  materiality,  impact,  and  risk  when  determining  when 
tin  area  is  ready  for  assertion.  Air  Force  management  dues  not  believe  that  the  issues  that 
the  corrective  actions  in  our  Military  Equipment  assertion  are  intended  to  address  are 
significant  control  weaknesses.  The  FIAR  guidance  does  not  prevent  the  services  from 
going  forward  with  an  assertion  that  has  corrective  actions.  As  an  example.  Air  Force 
Budget  Authority  received  an  unqualified  opinion  from  an  IPA  even  though  there  were 
outstanding  corrective  actions.  The  Air  Force  considers  its  ov  ersight  process  extensive 
and  has  delayed  important  assertions  fur  missile  motors  and  spare  engines  when  the 
corrective  actions  were  material  and  not  supportable. 

On  behalf  of  the  Secretary  of  Defense,  the  Under  Secretary  of  Defense 
(Comptroller), Chief  Financial  Officer  (USD(C>CFO)  is  reviewing  DoD  Component 
Financial  Improvement  and  Audit  Readiness  (FIAR)  plans  with  appropriate  DoD  leaders 
to  determine  w  hat  improvements  can  be  made  to  address  these  kind  of  deficiencies  and  as 
a  result,  speed  progress.  Upon  completion  of  this  review,  the  Secretary  will  issue  forma! 
direction  to  the  Service  Secretaries  and  other  leaders  on  additional  actions  they  must  take 
to  ensure  sufficient  and  qualified  resources  are  devoted  to  achieving  this  priority  in 
alignment  with  the  Department's  strategy  and  methodology  including  the  aspects  of  that 
methodology  noted  in  this  finding. 

RECOMMENDATION  10:  The  GAO  recommends  that  to  ensure  that  other  FIPs  from 
DOD  components  comply  with  the  requirements  in  the  FIAR  Guidance,  the  Secretary  of 
Defense  direct  the  Secretary  of  the  Army  and  the  heads  of  other  DOD  components  to 
consider  the  weaknesses  identified  in  this  report  when  preparing  their  F  iPs. 

DoD  RESPONSE:  Concur.  On  behalf  of  the  Secretary  °*  Defense,  the  Under  Secretary 
of  Defense  (Comptroller),  Chief  Financial  Officer  (USD(C),X  TO)  is  reviewing 
DoDfComponent  Financial  Improvement  and  Audit  Readiness  (FIAR)  plans  with 
appropriate  DoD  leaders  to  determine  what  improvements  can  be  made  to  address  these 
kind  of  deficiencies  and  as  a  result,  speed  progress.  Upon  completion  of  this  review,  the 
Secretary  will  issue  formal  direction  to  the  Service  Secretaries  and  other  leaders  on 
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additional  actions  they  must  take  to  ensure  sufficient  and  qualified  resources  are  devoted 
to  achieving  this  priority  in  alignment  with  the  Department’s  strategy  and  methodology 
including,  the  aspects  of  that  methodology  noted  in  this  finding. 

In  addition,  The  Assistant  Secretary  of  the  Amy  (Financial  Management  and 
Comptroller)  has  begun  a  comprehensive  review  to  validate  the  Army’s  FTP  fully  meets 
the  OliSD(C)  FIAR  Guidance.  Specifically,  the  Army  has  placed  increased  priority  on 
the  recommendations  provided  by  GAO  in  this  report  and  included  these 
recommendations  where  appropriate. 

RECOMMENDATION  1 1 :  The  GAO  recommends  that  the  Secretary  of  Defense  direct 
the  Co-Chairs  of  the  FIAR  Governance  Board  to  ensure  that  the  Board  carries  out  its 
responsibilities  for  identifying  risks  that  could  prevent  the  Department  from  achieving  its 
goals  and  ensuring  sufficient  documentation  of  FTP  assessment  results. 

DoD  RESPONSE:  Concur.  The  Department  has  instituted  several  actions  to  help 
ensure  that  Component's  perform  sufficient  analysis,  testing,  anti  documentation  in  their 
financial  improvement  efforts.  These  actions  include  the  establishment  of  a  quality 
assurance  team  composed  of  experienced  financial  statement  auditors  within  the  Office 
of  the  Under  Secretary  of  Defense  (Comptrollerf'Chicf  Financial  Officer 
(OUSDtCF'CFO)  Financial  Improvement  and  Audit  Readiness  (FIAR)  Directorate.  The 

FIAR  quality  assurance  team  reviews  Components  plans  and  documentation  as  they  are 

completed  to  provide  valuable  feedback  and  avoid  assertions  of  audit  readiness  not 

supported  by  sufficient  icsting  and.  analysis.  The  Co-Chairs  of  the  FIAR  Governance 
Board  will  require  the  FIAR  Directorate  to  report  to  the  Board  at  each  meeting  on  the 
results  of  these  reviews  in  order  to  identify  and  address  risks  to  achieving  audit  readiness 
goals. 

RECOMMENDATION  12:  The  GAO  recommends  that  the  Secretary  of  Defense  direct 
the  Secretary  of  the  Navy  to  ensure  that  all  responsible  parties  within  the  Navy,  including 
the  Assistant  Secretary  of  the  Navy  (Financial  Management  and  Comptroller),  carry  out 
their  responsibilities  for  ensuring  that  FIP  development  and  implementation  complies 
with  the  FIAR  Guidance  and  that  the  FIP  contains  sufficient  information  to  indicate  audit 
readiness  before  it  is  signed, 

DoD  RESPONSE;  Concur.  DON  will  continue  to  engage  all  relev  ant  business  process 
owners,  at  all  levels,  as  they  gauge  audit  readiness  in  assessable  units.  For  example, 
Assistant  Secretary  of  the  Navy  (Manpower  and  Reserve  Affairs)  co-signcd  the  Civilian 
Pay  management  assertion,  and  it  was  reviewed  by  the  DON  Audit  Committee.  On 
behalf  of  the  Secretary  of  Defense,  die  Under  Secretary  of  Defense  (Comptroller)  t  hief 
Financial  Officer  ( USD(C')  CFO)  is  reviewing  DoD  Component  Financial  Improvement 
and  Audit  Readiness  (FIAR)  plans  with  appropriate  DoD  leaders  to  determine  what 
improv  ements  can  he  made  to  address  these  kind  of  deficiencies  and  as  a  result,  speed 
progress.  Upon  completion  of  this  review,  the  Secretary  will  issue  formal  direction  to  the 
Service  Secretaries  and  other  leaders  on  additional  actions  they  must  take  to  ensure 
sufficient  and  qualified  resources  are  devoted  to  achieving  this  priority  in  alignment  with 
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i he  Department's  strategy  arul  methodology  including  the  aspects  of  that  methodology 
noted  m  this  finding. 

RECOMMENDATION  13:  The  GAO  recommends  that  the  Secretary  of  Defense  direct 
the  Secretary  of  the  Air  Force  to  ensure  that  all  responsible  patties  within  the  Air  Force, 
including  the  Assistant  Secretary  of  the  Air  Force  (Financial  Management  and 
Comptroller)  carry  out  their  responsibilities  for  ensuring  that  FIP  development  and 
implementation  complies  with  the  FI  Alt  Guidance  and  that  the  FIP  contains  sufficient 
information  to  indicate  audit  readiness  before  it  is  signed. 

DoD  RESPONSE:  Concur.  Air  Force  comments  indicate  Air  Force  leadership  carries 
out  its  responsibilities  for  all  aspects  of  audit  readiness  including  the  development  and 
execution  of  Financial  Improvement  Plans  through  the  assertion  review  and  submission 
process  until  final  validation  by  an  iPA  or  DoDIG.  The  Air  Force  will  rely  on  its  success 
operating  under  the  May  1 5,  20 1 0  FIAR  guidance  to  demonstrate  its  oversight  of  audit 
readiness  efforts.  The  Air  Force  received  an  unqualified  opinion  on  its  Budget  Authority 
assertion,  its  Fund  Balance  with  Treasury  Reconciliation  assertion  was  validated  by  OSD 
and  is  undergoing  examination  by  an  Independent  Public  Accounting  firm,  the  Air 
Force  FIAR  governance  process  has  delayed  assertions  that  Air  Force  leadership 
determined  were  not  supportable  ( missile  motors  and  spare  engines). 

On  behalf  of  the  Secretary  of  Defense,  the  Under  Secretary  o  f  Defense 
(Comptroller^ Chief  Financial  Officer  (l  fSD(C)  CFO)  is  reviewing  DoD  Component 
Financial  Improvement  and  Audit  Readiness  (FIAR)  plans  with  appropriate  DoD  leaders 
to  determine  what  improvements  can  be  made  to  address  these  kind  ot  deficiencies  and  as 
a  result,  speed  progress.  Upon  completion  of  this  review,  the  Secretary  will  issue  formal 
direction  to  the  Service  Secretaries  and  other  leaders  on  additional  actions  they  must  take 
to  ensure  sufficient  and  qualified  resources  are  devoted  to  achieving  this  priority  tn 
alignment  with  the  Department’s  strategy  and  methodology  including  the  aspects  of  that 
methodology  noted  in  this  finding. 
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GAO’s  Mission 

■ 

The  Government  Accountability  Office,  the  audit,  evaluation,  and 
investigative  arm  of  Congress,  exists  to  support  Congress  in  meeting  its 
constitutional  responsibilities  and  to  help  improve  the  performance  and 
accountability  of  the  federal  government  for  the  American  people.  GAO 
examines  the  use  of  public  funds;  evaluates  federal  programs  and 
policies;  and  provides  analyses,  recommendations,  and  other  assistance 
to  help  Congress  make  informed  oversight,  policy,  and  funding  decisions. 
GAO’s  commitment  to  good  government  is  reflected  in  its  core  values  of 
accountability,  integrity,  and  reliability. 

Obtaining  Copies  of 
GAO  Reports  and 
Testimony 

■ 

The  fastest  and  easiest  way  to  obtain  copies  of  GAO  documents  at  no 
cost  is  through  GAO’s  Web  site  (www.gao.gov).  Each  weekday 
afternoon,  GAO  posts  on  its  Web  site  newly  released  reports,  testimony, 
and  correspondence.  To  have  GAO  e-mail  you  a  list  of  newly  posted 
products,  go  to  www.gao.gov  and  select  “E-mail  Updates.” 

Order  by  Phone 

The  price  of  each  GAO  publication  reflects  GAO’s  actual  cost  of 
production  and  distribution  and  depends  on  the  number  of  pages  in  the 
publication  and  whether  the  publication  is  printed  in  color  or  black  and 
white.  Pricing  and  ordering  information  is  posted  on  GAO’s  Web  site, 
http://www.gao.gov/ordering.htm. 

Place  orders  by  calling  (202)  512-6000,  toll  free  (866)  801-7077,  or 

TDD  (202)  512-2537. 

Orders  may  be  paid  for  using  American  Express,  Discover  Card, 
MasterCard,  Visa,  check,  or  money  order.  Call  for  additional  information. 

To  Report  Fraud, 
Waste,  and  Abuse  in 
Federal  Programs 

■ 

Contact: 

Web  site:  www.gao.gov/fraudnet/fraudnet.htm 

E-mail:  fraudnet@gao.gov 

Automated  answering  system:  (800)  424-5454  or  (202)  512-7470 

Congressional 

Relations 

■ 

Ralph  Dawn,  Managing  Director,  dawnr@gao.gov,  (202)  512-4400 

U.S.  Government  Accountability  Office,  441  G  Street  NW,  Room  7125 
Washington,  DC  20548 

Public  Affairs 

■ 

Chuck  Young,  Managing  Director,  youngcl@gao.gov,  (202)  512-4800 
U.S.  Government  Accountability  Office,  441  G  Street  NW,  Room  7149 
Washington,  DC  20548 
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